GoDaddy Revokes More Than 400,000 Certificates After Documentation Errors
GoDaddy is revoking more than 400,000 TLS certificates after finding that their certificate-policy references did not match the documentation that applied when they were issued. The certificates do not have a technical defect, but they still have to be withdrawn under certificate-authority rules. Customers of Host Europe and DomainFactory are among those affected, and GoDaddy says it has already issued replacements and automatically swapped the old certificates where possible.
The distinction matters for operators: a certificate can contain correct technical information and still be non-compliant because the associated policy documentation is wrong. The affected certificates include object identifiers and URLs pointing to the relevant Certificate Policy and Certification Practice Statement. The problem was in that CP/CPS documentation, not in the values recorded in the certificates themselves.
Most of the affected certificates are domain-validated certificates issued by GoDaddy's Starfield Technologies. The reported totals include more than 200,000 certificates in the active Starfield R1 DV hierarchy and almost 190,000 in Starfield G2 DV. GoDaddy identified eight affected certificate hierarchies after external parties pointed out some discrepancies and the provider found additional ones during its review.
The compliance deadline has already become part of the incident. The CA/Browser Forum's Baseline Requirements require certificates affected by this type of documentation error to be revoked within five days. That period ended on October 18, while fewer than half of the certificates had been revoked at that point. GoDaddy opened a second incident report to document the missed deadline.
For affected businesses, the immediate task is to confirm that replacement certificates are installed and being served by every relevant system, rather than assuming that an automated exchange covered all endpoints. GoDaddy said it was trying to contact customers where automatic replacement was not possible. Host Europe and DomainFactory customers were given until October 21 at 21:00 CEST to replace certificates, but the provider's next progress update was still outstanding in the supplied report.