GoDaddy has revoked 404,607 SSL/TLS certificates after discovering that they failed to comply with its public certificate policies. The company, which also manages the Starfield CA chain, announced that the incorrect certificates were officially revoked on October 21, 2026.
What Went Wrong
An external party alerted GoDaddy to mismatches between the issued certificates and its defined Certificate Policy and Certification Practice Statement (CP/CPS). Key areas of divergence included policy OIDs and CPS URI qualifiers—elements meant to ensure transparency and trust in how certificates are issued. Importantly, no stolen private keys were reported; the issue was strictly about nonconformance with documentation. Once GoDaddy confirmed the problem, it paused certificate issuance to correct the discrepancies across both its active Starfield and older Starfield G2 chains, the latter of which was no longer issuing new certificates.
Scope and Timing of the Revocation
These compliance failures largely involved certificates validated via domain control. Specifically, Starfield R1 DV accounted for around 208,896 certificates, and Starfield G2 DV for about 187,159. The rest were smaller counts of organization-validated (OV) and extended-validation (EV) certificates.
The trouble also included a missed deadline. Under the Baseline Requirements section 4.9.1.1, GoDaddy was required to revoke non-conforming certificates within 24 hours, or at most within five days for those not short-lived. The company initiated outreach to affected customers starting October 14, 2026, including those in critical sectors—health, finance, and government. However, by the deadline on October 18 at 23:45 UTC, only about 170,566 had been revoked. That number rose to 227,422 by early October 19. The full revocation count was reached on October 21 when the process was completed.
What Customers Need to Do
Owners of affected certificates are urged to check their GoDaddy account’s SSL certificate section to ensure any replacement certificates have been both issued and installed. Using a new certificate in your account doesn’t guarantee it’s active; domains might still be serving old, revoked certs until the swap is made. Users may see browser warnings or other access issues if their site continues using an invalid certificate.
This incident echoes past lapses—such as certificate revocations by another major CA over a DNS validation bug—and reinforces concerns around certificate lifecycle management and operational oversight.
Why this matters: such mismatches compromise the integrity and trust at the core of TLS/SSL operations. Organizations depending on certificates from GoDaddy or Starfield must verify both documentation and deployment practices. As the web evolves, compliance with CP/CPS and Baseline Requirements isn’t optional—it’s vital for maintaining a secure internet.
