GoDaddy revokes 404,607 TLS certificates due to compliance failures

Key Takeaways

• GoDaddy initiated a mass revocation of over 400,000 TLS certificates due to non-compliance with its published certificate policies.
• The affected certificates were issued under both GoDaddy and Starfield certificate chains.
• GoDaddy failed to meet the industry-mandated five-day deadline for revoking non-compliant certificates, incurring a secondary compliance violation.
• Users of affected certificates may experience browser security warnings or website access issues until a replacement certificate is installed.

GoDaddy Revokes 404,607 TLS Certificates Over Compliance Lapses

GoDaddy has undertaken a significant revocation of 404,607 SSL/TLS certificates after discovering that numerous issued certificates did not align with the company’s officially published certificate policies. This action was further complicated by GoDaddy missing the stipulated deadline for these revocations, leading to a second compliance breach. According to GoDaddy’s customer guidance, all incorrectly issued certificates were ultimately revoked by October 21, 2026.

This incident impacts certificates issued under both the GoDaddy and Starfield certificate authority chains. Customers who are still utilizing an affected certificate may encounter browser security warnings or experience difficulties accessing their websites until a new, compliant certificate is properly installed. It is crucial for customers to understand that receiving a replacement certificate in their account does not automatically mean their website is using it.

Details of the Compliance Failure

The issue came to light following a report from a third party, as detailed in the original incident report. This report highlighted discrepancies between certificates issued by Starfield and the profiles outlined in its Certificate Policy and Certification Practice Statement (CP/CPS) documents. These foundational documents govern the rules and procedures a certificate authority must adhere to when issuing certificates.

Specifically, the discrepancies involved critical certificate policy information, including policy object identifiers (OIDs) and CPS URI policy qualifiers. These fields are essential for identifying the specific certificate policies and referencing the certificate authority’s public documentation. The certificates in question did not accurately reflect the documented profiles. It is important to note that the reports describe a compliance failure related to policy, not a confirmed compromise or theft of private keys.

Upon confirming the initial report, GoDaddy immediately halted further certificate issuance. Its subsequent internal investigation revealed additional inconsistencies across various affected profiles. The company then corrected and published updated documentation before resuming certificate issuance. Further internal audits also uncovered similar issues within the older Starfield G2 chain, which, while no longer actively issuing certificates, still contained affected legacy certificates.

The majority of the revoked certificates were domain-validated (DV) certificates. The Starfield R1 DV chain accounted for 208,896 certificates, while the Starfield G2 DV chain contributed 187,159. A smaller number of organization-validated (OV) and extended validation (EV) certificates across both the GoDaddy and Starfield chains were also impacted by this compliance lapse.

GoDaddy Missed Revocation Deadline

A significant aspect of this incident is GoDaddy’s failure to adhere to industry-standard revocation timelines. The delayed revocation report references Section 4.9.1.1 of the TLS Baseline Requirements. This standard mandates that for the type of policy violation identified, affected certificates must be revoked within five days, with an ideal target of 24 hours, excluding short-lived subscriber certificates. The specified reason for revocation in such cases is “superseded.”

GoDaddy commenced outreach to affected subscribers on October 14. This communication effort targeted a broad range of customers, including those with extensive certificate inventories and organizations operating in sensitive sectors such as government, finance, and healthcare. However, by the October 18 deadline at 23:45 UTC, only 170,566 certificates had been successfully revoked.

By 05:29 UTC on October 19, the total number of revoked certificates had increased to 227,422. GoDaddy stated that dedicated teams were actively managing customer contact, certificate replacement, revocation processes, and progress tracking through multiple channels, including email, SMS, and phone calls. The company’s subsequent customer notice confirmed that all incorrectly issued certificates were ultimately revoked by October 21.

This event draws parallels with earlier DigiCert certificate revocations stemming from a DNS validation error, although the specific underlying failures differ. It also underscores critical operational concerns related to certificate mismanagement, a topic frequently highlighted in cybersecurity reporting.

What You Should Do

• Check Your GoDaddy Account: Administrators should promptly review the SSL certificate section within their GoDaddy account for any notices regarding affected certificates.
• Install Replacement Certificates: If a replacement certificate is available, download and install it immediately. Note that a new certificate appearing in your account does not mean it is actively deployed on your domain.
• Verify Installation: After installation, verify that your website is serving the new certificate to avoid browser warnings and ensure continuous secure access for users.
• Monitor for Warnings: Be vigilant for any browser security warnings or access issues reported by users, which could indicate an unreplaced or improperly installed certificate.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.