GoDaddy has embarked on a mass revocation of 404,607 SSL/TLS certificates after discovering discrepancies between issued certificates and its published policies. The company failed to meet the required revocation deadline, which resulted in an additional compliance issue. According to an updated customer notification, the affected certificates were revoked on October 21, 2026.
Impact on Certificate Chains
The revocation affects certificates issued under both the GoDaddy and Starfield certificate chains. Customers with impacted certificates may experience browser security alerts or website access issues until they replace their certificates, as advised by GoDaddy. It is important to note that merely receiving a replacement does not confirm its installation on the website.
Compliance Discrepancies Revealed
The initial incident report indicates that a third-party identified inconsistencies between issued certificates and the profiles outlined in Starfield’s Certificate Policy and Certification Practice Statement, or CP/CPS. These documents set the rules for certificate issuance. The discrepancies involved certificate policy details, particularly policy object identifiers and CPS URI policy qualifiers, which identify certificate policies and reference the certificate authority’s published practices.
Upon confirming the report, GoDaddy halted certificate issuance. Further analysis revealed additional inconsistencies in the affected profiles, prompting updates to the documentation before resuming issuance. Similar issues were identified in the older Starfield G2 chain, which was no longer actively issuing certificates.
Revocation Delays and Customer Outreach
The delayed revocation report refers to Section 4.9.1.1 of the TLS Baseline Requirements, which mandates that affected certificates be revoked within 24 hours, with a maximum period of five days, except for short-lived certificates. The specified reason for revocation is “superseded.”
GoDaddy began notifying subscribers on October 14, targeting those with significant certificate inventories and organizations in government, finance, and healthcare sectors. By the deadline on October 18, only 170,566 certificates had been revoked. By 05:29 UTC on October 19, the number reached 227,422. The company reported that dedicated teams managed customer communications, replacement, and revocation processes through various channels.
Administrators are advised to check their GoDaddy accounts for SSL certificate updates and follow any replacement instructions. GoDaddy cautions that a new certificate can appear in the account while the domain continues using the outdated one. Users receiving an installation alert should promptly download and install the replacement certificate.
This incident is reminiscent of previous DigiCert certificate revocations due to DNS validation errors, although the underlying issues differ. It underscores the operational challenges highlighted in Cybersecurity News’ coverage of certificate mismanagement.
