GoDaddy launched a mass revocation of 404,607 SSL/TLS certificates after finding that issued certificates did not match its published certificate policies. The company missed its required revocation deadline, creating a second compliance issue. An updated customer notice says the incorrectly issued certificates were revoked on October 21, 2026.

The incident affects certificates issued under GoDaddy and Starfield certificate chains. Customers still using an affected certificate may face browser security warnings or website access problems until they install a replacement, according to GoDaddy’s customer guidance. Receiving a replacement alone does not confirm that the website is using it.

GoDaddy Revoking 404,607 TLS Certificates

According to the original incident report, a third party flagged differences between issued certificates and the profiles described in Starfield’s Certificate Policy and Certification Practice Statement, known as CP/CPS. These documents set out the rules the certificate authority follows when issuing certificates.

The differences involved certificate policy information, including policy object identifiers, or OIDs, and CPS URI policy qualifiers. These fields identify certificate policies and reference the authority’s published practices. The issued certificates did not match the documented profiles. The reports describe a compliance failure, not a confirmed theft of private keys.

GoDaddy stopped certificate issuance after confirming the report. Its investigation uncovered additional differences across affected profiles. The company corrected and published its documentation before resuming issuance. Further checks found similar problems in the older Starfield G2 chain, which was no longer actively issuing certificates.

Domain validated certificates made up most of the affected population. Starfield R1 DV accounted for 208,896 certificates, while Starfield G2 DV accounted for 187,159. Smaller numbers of organization validated and extended validation certificates were also affected across the GoDaddy and Starfield chains.

GoDaddy Missed the Revocation Deadline

The delayed revocation report cites Section 4.9.1.1 of the TLS Baseline Requirements. For the stated policy violation, affected certificates should be revoked within 24 hours and must be revoked within five days, except for short-lived subscriber certificates. The specified revocation reason is “superseded.”

GoDaddy began contacting subscribers on October 14. Its outreach included customers holding large certificate inventories and organizations providing government, financial, and health services. However, only 170,566 certificates had been revoked when the October 18 deadline passed at 23:45 UTC.

By 05:29 UTC on October 19, the revoked total had reached 227,422. GoDaddy said dedicated teams were handling customer contact, replacement, revocation, and progress tracking through email, SMS, and phone calls. Its later customer notice states that the incorrectly issued certificates were revoked on October 21.

Affected administrators should review the SSL certificate section of their GoDaddy account and follow any replacement notice. GoDaddy warns that an updated certificate can exist in the account while the domain continues serving the old certificate. Customers receiving an installation alert should download and install the replacement immediately.

The case echoes earlier DigiCert certificate revocations following a DNS validation error, although the underlying failures differ. It also highlights the operational concerns covered in Cybersecurity News’ report on certificate mismanagement.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post GoDaddy Revoking 404,607 TLS Certificates Following Compliance Failures appeared first on Cyber Security News.