GoDaddy revokes 404,607 SSL/TLS certificates over CP/CPS profile non-compliance
GoDaddy revoked 404,607 SSL/TLS certificates effective October 21, 2026, after finding that some subscriber certificates were issued outside the profiles defined in its Certification Practice Statement (CPS) and Certificate Policy (CP). The incident is tracked in Mozilla's CA Certificate Compliance program as Bug 2082703, which remains open. The article reports no private-key compromise or malicious intent, so this is a mis-issuance and certificate-lifecycle event, not an attack. Customers who do not install the replacement certificates risk browser revocation errors and outages on customer portals, e-commerce sites, APIs, email services and VPN gateways.
Detalhes técnicos
- The root cause is a mismatch between the technical settings used to issue certificates and the CA's documented CP/CPS rules. Examples are an incorrect extension, key-usage setting, validity configuration or subject-profile requirement.
- GoDaddy says the affected certificates were re-issued, but the new certificate must still be deployed on the web server, load balancer, CDN or hosting platform.
- Affected certificates may show portal messages such as "Action required: Install your new certificate", "We couldn't check your website" or "This certificate needs your attention". Certificates marked "No action needed" require nothing.
Remediação
- Download the replacement certificate from the GoDaddy portal ("Download Zip File" or "Download Certificate for Deluxe Automated SSL") and install it, including the intermediate chain.
- Inventory all public endpoints and identify GoDaddy-issued certificates.
- Check automated renewal pipelines, reverse proxies, Kubernetes ingress controllers, cloud load balancers and third-party managed hosting, where the certificate may not sit on the primary application server.
- Validate the live deployment from an external network, for example with GoDaddy's SSL Status Check tool.
- Adopt continuous certificate discovery and automated renewal.
Linha do tempo
-
GoDaddy revokes 404,607 SSL/TLS certificates over CP/CPS profile non-compliance
ler a análise desta fonte ocultar
GoDaddy revoked 404,607 SSL/TLS certificates effective October 21, 2026, after finding that some subscriber certificates were issued outside the profiles defined in its Certification Practice Statement (CPS) and Certificate Policy (CP). The incident is tracked in Mozilla's CA Certificate Compliance program as Bug 2082703, which remains open. The article reports no private-key compromise or malicious intent, so this is a mis-issuance and certificate-lifecycle event, not an attack. Customers who do not install the replacement certificates risk browser revocation errors and outages on customer portals, e-commerce sites, APIs, email services and VPN gateways.
Technical Details
- The root cause is a mismatch between the technical settings used to issue certificates and the CA's documented CP/CPS rules. Examples are an incorrect extension, key-usage setting, validity configuration or subject-profile requirement.
- GoDaddy says the affected certificates were re-issued, but the new certificate must still be deployed on the web server, load balancer, CDN or hosting platform.
- Affected certificates may show portal messages such as "Action required: Install your new certificate", "We couldn't check your website" or "This certificate needs your attention". Certificates marked "No action needed" require nothing.
Remediation
- Download the replacement certificate from the GoDaddy portal ("Download Zip File" or "Download Certificate for Deluxe Automated SSL") and install it, including the intermediate chain.
- Inventory all public endpoints and identify GoDaddy-issued certificates.
- Check automated renewal pipelines, reverse proxies, Kubernetes ingress controllers, cloud load balancers and third-party managed hosting, where the certificate may not sit on the primary application server.
- Validate the live deployment from an external network, for example with GoDaddy's SSL Status Check tool.
- Adopt continuous certificate discovery and automated renewal.