GoDaddy Revokes Over 400,000 TLS Certificates Due to Policy Non-Compliance
GoDaddy is revoking more than 404,000 TLS certificates after discovering they were issued in violation of the company's own policies, compounded by a failure to meet the mandatory revocation deadline.
GoDaddy has initiated a mass revocation of 404,607 SSL/TLS certificates following the discovery that these certificates were issued without adhering to the company's published certificate policies. This compliance failure was further exacerbated by GoDaddy missing the required deadline for revoking these non-conforming certificates, marking a second significant compliance issue.
The company's updated customer notice confirms that the incorrectly issued certificates were revoked on October 21, 2026. The incident impacts certificates issued under both the GoDaddy and Starfield certificate chains. Customers whose websites are still utilizing an affected certificate may encounter browser security warnings or experience disruptions in website access until they install a replacement certificate. GoDaddy has emphasized that merely receiving a replacement certificate does not automatically guarantee its active use on the website.
The root cause of the issue was identified when a third party flagged discrepancies between the issued certificates and the profiles detailed in Starfield's Certificate Policy and Certification Practice Statement (CP/CPS). These documents are foundational, outlining the strict rules a Certificate Authority must follow during the issuance process. The identified differences pertained to certificate policy information, specifically policy object identifiers (OIDs) and CPS URI policy qualifiers, which are crucial for identifying certificate policies and referencing the authority's documented practices.
GoDaddy promptly halted all certificate issuance upon confirming the report and launched an investigation. This inquiry uncovered additional policy deviations across various affected profiles. Before resuming certificate issuance, the company undertook the necessary steps to correct and republish its documentation. Further internal checks revealed similar compliance problems within the older Starfield G2 chain, although this chain was no longer actively issuing new certificates.
Domain-validated (DV) certificates constituted the majority of the affected certificates. The Starfield R1 DV chain accounted for 208,896 certificates, while the Starfield G2 DV chain was responsible for 187,159. A smaller number of organization-validated and extended validation certificates were also found to be affected across both the GoDaddy and Starfield certificate chains.
Adding to the compliance failures, GoDaddy missed the mandatory revocation deadline stipulated by Section 4.9.1.1 of the TLS Baseline Requirements. This requirement mandates that certificates with policy violations must be revoked within 24 hours, and no later than five days, unless they are short-lived subscriber certificates. The specified reason for revocation in such cases is 'superseded.'
GoDaddy began its outreach to affected subscribers on October 14, 2026, including customers with extensive certificate inventories and organizations in critical sectors like government, finance, and healthcare. However, by the deadline of October 18, 2026, at 23:45 UTC, only 170,566 certificates had been revoked. Even by 05:29 UTC on October 19, the revoked count had only reached 227,422. GoDaddy stated that dedicated teams were actively engaged in customer communication, replacement processing, revocation, and progress tracking via email, SMS, and phone.
This incident bears resemblance to earlier certificate revocations by DigiCert, which also stemmed from validation errors, though the specific technical failures differ. It underscores the broader operational challenges and risks associated with certificate lifecycle management and highlights the importance of rigorous adherence to established policies and deadlines in maintaining trust within the digital certificate ecosystem.