GoDaddy SSL Revocation: 404,607 Certificates Pulled After Policy Errors

GoDaddy announced on October 21, 2026 that it had revoked 404,607 SSL/TLS certificates after discovering that the certificates it had issued did not match Starfield’s published Certificate Policy and Certification Practice Statement (CP/CPS). The mismatch involved certificate policy object identifiers (OIDs) and CPS URI qualifiers, which define the policy under which a certificate is issued and point to the authority’s documented practices.

The error surfaced when a third-party audit noted the OID discrepancies. GoDaddy halted new certificate issuance, corrected its documentation, and resumed issuance after a review that also uncovered similar issues in the older Starfield G2 hierarchy, which no longer issues new certificates.

Scale of the Impact

Most of the affected certificates were domain-validation (DV). Starfield R1 DV accounted for 208,896 certificates, Starfield G2 DV for 187,159, and an additional 8,552 organization-validation (OV) and extended-validation (EV) certificates were impacted across the hierarchies.

Revocation Timeline and Compliance

The CA/Browser Forum’s TLS Baseline Requirements mandate that affected certificates be revoked within 24 hours and within five days, subject to exceptions. GoDaddy began contacting customers on October 14 but missed the October 18 23:45 UTC deadline. At that point, only 170,566 certificates had been revoked. By 05:29 UTC on October 19, the count rose to 227,422, and the final revocation was completed on October 21.

GoDaddy’s customer guidance warned that sites may display security warnings or become inaccessible until a replacement certificate is installed. The company’s dashboard identifies certificates requiring action, including cases where a new certificate is available but the website is still using the revoked one. An SSL Status Check tool is available for verifying a certificate’s current status.

Gibraltar Government Sites Affected

The incident reached Gibraltar’s government websites. On October 22, the government confirmed that some sites were using affected certificates and that its IT team was working to replace them. Visitors were advised not to ignore browser security warnings or enter personal or payment details on affected pages.

What Site Owners Should Verify

  1. Log into the GoDaddy account and review the dashboard for certificates flagged for replacement.
  2. Check the live website: downloading a replacement does not install it automatically; the server must present the new certificate.
  3. Use the SSL Status Check tool to confirm the certificate’s revocation status.
  4. If a site continues to present a revoked certificate, users will see security warnings or connection errors.

Operational Consequences for Users

Users visiting sites with revoked certificates may encounter browser security warnings or be unable to load the site entirely. The warning can deter traffic and erode trust, especially for sites handling sensitive data.

Second-Order Effects on the CA Ecosystem

The scale of the revocation underscores the importance of strict policy adherence in large certificate hierarchies. A single OID mismatch can cascade into hundreds of thousands of sites, forcing widespread revocation and replacement cycles. The incident may prompt other CAs to audit their issued certificates for policy compliance more aggressively.

Open Question: How Will GoDaddy Prevent Future Policy Drift?

GoDaddy’s public statements indicate that it has corrected its documentation and resumed issuance, but the mechanics of ongoing policy validation remain unclear. Observers will watch for updates on automated policy checks and cross-hierarchy consistency measures.

The incident follows a May case where attackers obtained DigiCert code-signing certificates and used them to sign malware. In that scenario, the published disclosures concerned certificate misuse rather than policy errors, but both cases highlight the critical role of certificate integrity in securing web traffic.

For further context on how certificate revocation can affect domain ownership and security, see the Legacy Virtualization Stacks Force IT to Re-architect: When the Cost of Keeping Old Systems Wins Out.

Explore more on this topic