Press play to start listening
GoDaddy revoked 404,607 SSL (Secure Sockets Layer) and TLS (Transport Layer Security) certificates on October 21, 2026, after finding errors in how they had been issued. The affected certificates were issued under GoDaddy and Starfield.
The issue came to light after a third party found that the certificates did not match Starfield’s published Certificate Policy and Certification Practice Statement (CP/CPS). The differences involved certificate policy object identifiers (OIDs) and CPS URI qualifiers, which identify the policies associated with a certificate and point to the authority’s documented practices.
GoDaddy suspended certificate issuance while investigating, corrected its published documentation and resumed issuance. Its review also identified similar discrepancies in the older Starfield G2 hierarchy, which no longer issued new certificates, according to Mozilla’s incident report.
Domain-validation (DV) certificates accounted for most of the affected population. Starfield R1 DV accounted for 208,896 certificates, while Starfield G2 DV accounted for 187,159. Another 8,552 organization-validation (OV) and extended-validation (EV) certificates were affected across the listed certificate hierarchies.
GoDaddy Missed Its Revocation Deadline
The CA/Browser Forum’s TLS Baseline Requirements state that affected certificates should be revoked within 24 hours and must be revoked within five days, subject to exceptions.
GoDaddy began contacting affected customers on October 14 but missed its October 18 deadline at 23:45 UTC. By then, only 170,566 certificates had been revoked. The total reached 227,422 by 05:29 UTC on October 19, according to Mozilla’s delayed-revocation report. GoDaddy’s customer guidance subsequently confirmed that the affected certificates were revoked on October 21.
In its customer guidance notice, the company warns that websites may display security warnings or become inaccessible until a replacement certificate is installed. Its dashboard identifies certificates requiring action, including cases where a new certificate is available but the website is still using the revoked one. GoDaddy also provides an SSL Status Check tool for verifying a certificate’s current status.
What Website Owners Should Do
The problem has reached Gibraltar’s government websites. On October 22, the government confirmed that some sites were using affected certificates and its IT team was working to replace them. Visitors were told not to ignore browser security warnings or enter personal or payment details on affected pages.
“An error by GoDaddy, one of the companies that issues website security certificates worldwide, has affected some HM Government of Gibraltar websites.”
“Visitors to these sites may see a security warning in their browser, or may be unable to open the site, until a replacement certificate is in place,” official notification from the Government of Gibraltar noted.
Website owners should check their GoDaddy accounts for certificates flagged for replacement. They also need to check the live website: downloading a replacement does not install it automatically. If the server continues presenting the revoked certificate, visitors may still encounter security warnings or connection errors.
The incident follows another certificate-related security case covered by Hackread.com in May, when attackers obtained DigiCert code-signing certificates and used them to sign malware. In the GoDaddy case, the published disclosures concern certificate-policy discrepancies and do not establish private-key theft or a compromise of TLS encryption.
Certificate Revocation Highlights Need for Automation
Chris Hickman, Chief Security Officer at Keyfactor, shared his comments with Hackread.com on the GoDaddy incident and the importance of certificate management.
“The reason GoDaddy had to revoke more than 400,000 certificates is that there was a mismatch between the way the certificates were issued and the documentation that backs that up — their Certificate Policy and Certification Practice Statement, or CP/CPS. That requires them to revoke the certificates and reissue them as per the CA Browser Forum who oversees the guidelines that govern publicly rooted certificates like those issued by GoDaddy. So, this is actually a documentation error that led to this.
“The thing I really want to point to is that, of all the certificates that needed to be replaced, those that were automated simplified the job. However, for those that were not, the owners of those systems may not even realize that their certificates have been revoked and could be suffering an outage.
“This really does clarify the need to be agile with certificate management and the automation of certificates, and to have the visibility to understand when an event like this impacts certificates that have been issued to you.
“The guidance is: if you have certificates in your environment issued by one of the impacted certificate authorities, you need to confirm with GoDaddy whether your certificates are affected and, if they have been revoked, obtain the new certificate for the affected systems.”
