ABUJA (CONVERSEER) – Nigeria’s official presidency website, statehouse.gov.ng, has been exposed to hacking, operating with an expired SSL certificate since 7th May 2025, triggering browser warnings of an insecure connection
This is despite a significant budget for IT maintenance. The 2025 State House budget includes multiple line items under code 22020404 (Maintenance of Office/IT Equipment), totalling ₦203.35m across eight allocations: ₦23.656m, ₦2.77m, ₦18.01m, ₦125.89m, ₦7.95m, ₦7.65m, ₦7.98m, and ₦10m, respectively.
The same State House budget has multiple allocations under unnamed titles for IT running into billions.
While these funds cover IT equipment maintenance, it is unclear how much is allocated to website upkeep, including SSL certificate renewals, which are relatively inexpensive.
IT experts warned that the lack of an SSL certificate could expose users to risks like data interception and compromised security and render the site vulnerable.
As of Thursday, the certificate remained unrenewed.
According to THE WHISTLER, IT expert explained the importance of SSL certificates saying it encrypts user connections, ensuring privacy and authenticity.
An expired certificate, therefore, undermines these protections.
The State House’s website has been operating with an expired Certum Domain Validation CA SHA2 SSL certificate. The certificate, issued by Certum (Unizeto Technologies S.A.), provides basic domain-validated encryption.
THE WHISTLER’s findings showed that the cost of a Certum Domain Validation CA SHA2 certificate, also known as the Certum Commercial SSL, varies by provider.
In Nigeria, certum.ng lists the Commercial SSL at approximately ₦30,000 to ₦505,750 annually for a single domain, with issuance typically within minutes due to automated domain validation.
Alternatively, free options like ‘Let’s Encrypt’ could eliminate costs entirely. This raises questions about why the lapse occurred, given the low cost and availability of automation.
This is not the first time this has happened. In April 2024, the statehouse.gov.ng website was reported vulnerable due to the use of an outdated HTTP protocol instead of HTTPS.
Also, in recent years, other federal government websites have faced similar SSL certificate expirations, exposing systemic challenges in maintaining secure digital infrastructure.
For instance, in 2024, reports surfaced about the citizens.cdcu.osgf.gov.ng website, the official website of the Central Delivery Coordination Unit (CDCU), which was experiencing intermittent SSL issues, though these were resolved after the media reported it.
Similarly, the National Health Insurance Scheme (NHIS) website, nhis.gov.ng, faced criticism in the same year for an expired certificate, which lasted four months.
These recurring issues suggest a lack of automated certificate management or oversight within government IT systems.
The National Information Technology Development Agency (NITDA), responsible for overseeing .gov.ng domain registrations, has not commented on the expired certificate. Calls to the agency’s public relations officer, Hadiza Umar, rang out without response.
Also, a text message sent to her was not replied to as of the time of publication of this report.
Despite NITDA’s mandate for robust security, including SSL certification, enforcement appears inconsistent.
Experts recommend adopting automated certificate management systems, like Sectigo Certificate Manager or Cloudflare’s Universal SSL, to prevent such lapses.
Globally, similar issues have occurred. In 2019, over 80 U.S. government websites, including those of NASA and the Department of Justice, faced expired SSL certificates during a federal shutdown, rendering them insecure or inaccessible, according to reports by Netcraft and TechCrunch.
The State House IT team is yet to respond to this issues at the time of this report.
