GoDaddy Is Revoking 404,607 Certificates Because They Don't Match Its Own Rulebook
In October 2026 GoDaddy began revoking 404,607 TLS certificates because the certificate policy information inside them did not match the certificate profiles in its own published CP/CPS (Mozilla Bug 2082703). The Baseline Requirements give a CA five days to revoke such certificates. GoDaddy started contacting customers on October 14 and missed the October 18 deadline: it had revoked 170,566 certificates by then and 227,422 by October 19, leaving 177,185 (Mozilla Bug 2083191). The certificates work normally until they are revoked, and a revocation does not change the file on your server, so it can only be detected from outside.
GoDaddy is revoking 404,607 TLS certificates (Mozilla Bug 2082703). Nothing was hacked and no private key leaked. Someone outside the company compared GoDaddy's certificates with GoDaddy's own published rulebook and found that they did not match. Under the industry rules, a certificate that does not match its CA's rulebook has to be revoked within five days.
GoDaddy started contacting customers on October 14 and missed the October 18 deadline. By then it had revoked 170,566 certificates, and by early on October 19 it had revoked 227,422, which leaves 177,185 still to go (Mozilla Bug 2083191). If one of those is on your site, it will stop being trusted on a day GoDaddy picks, not you.
What was wrong with the certificates
Every certificate carries a few lines that say which rules it was issued under: a policy number, and a link to the CA's policy document. Each CA publishes a rulebook, called a CP/CPS, that spells out what those lines should say for every kind of certificate it issues.
In these certificates, the policy lines did not match what GoDaddy's rulebook said they should contain. That is the whole defect. The domain names, the dates and the encryption were fine, and until it is revoked each certificate works normally in every browser.
It still counts. When a CA learns that a certificate was not issued the way its own rulebook says, the rules give it five days to revoke it. The same thing happened to HARICA in July, when its rulebook drifted out of sync with its issuance system and it had to revoke 63,525 certificates.
Once the report came in, GoDaddy stopped issuing certificates, corrected its rulebook and started again, so certificates issued since then match it. The ones already issued cannot be corrected. They can only be replaced.
Which certificates are affected
GoDaddy listed the affected certificates by the intermediate CA that issued them. Starfield is part of GoDaddy, and almost all of the affected certificates are basic DV certificates from Starfield.
| Issued by | Type | Certificates |
|---|---|---|
| Starfield R1 | DV | 208,896 |
| Starfield G2 | DV | 187,159 |
| GoDaddy R1 | OV | 4,041 |
| Starfield G2 | OV | 2,134 |
| GoDaddy R1 | EV | 1,141 |
| Starfield R1 | OV | 928 |
| Starfield G2 | EV | 199 |
| Starfield R1 | EV | 109 |
| Total | 404,607 |
GoDaddy has not yet said when the mismatch started, so it has not said which issue dates are affected. Its full incident report should answer that. Until then, if your certificate comes from one of GoDaddy's or Starfield's TLS intermediates, check with GoDaddy rather than assume it is fine.
Why the delay does not help you
Missing the deadline does not mean your certificate will be left alone. GoDaddy says it will revoke every affected certificate as quickly as possible, and it revoked more than 56,000 in the few hours after the deadline alone. It is contacting customers by email, text message and phone, including those with many certificates and government, financial and health services. Its next public update is due on October 22. The extra time belongs to GoDaddy, not to you. You do not know which day yours goes.
When it goes, the certificate file on your server does not change. Your server keeps sending it, and every check you run on the server itself still says it is fine. Browsers that check revocation will show your visitors a full-page security warning instead of your site. Not every browser checks every certificate, so you can end up with a site that works for some visitors and fails for others, which is the hardest kind of problem to track down.
What to do this week
- Find out who issued your certificate. Click the padlock in your browser and look at the issuer, or run a free scan. If it says GoDaddy or Starfield, keep reading.
- Look for a message from GoDaddy. GoDaddy says it has been contacting affected customers since October 14, by email, text message and phone. If you got one, do not wait for the revocation date. Yours may already be revoked.
- Replace the certificate, then check it. Install the new certificate everywhere the old one is used, such as load balancers, CDNs and mail servers, and reload each service. Then scan the site again to confirm the new certificate is the one being served. A replacement that is issued but not installed fixes nothing.
- If you are not sure, ask. If your certificate comes from one of the intermediates above and you have not heard anything, contact GoDaddy and ask whether it is on the list.
How TLS Radar helps
You cannot see a revocation like this coming by looking at the certificate. You can only detect it once it happens, and you have to detect it from outside your server, the way a browser does.
On Business and Enterprise plans, TLS Radar checks the revocation status of the certificate your site is actually serving, on every scan. If GoDaddy revokes it, the grade drops to F and you get an alert that names the domain and tells you what to do. When several certificates we monitor from the same CA are revoked within a day, the alert also says it looks like part of a wider revocation by that CA, so you know the cause is on their side, not yours.
The free scan does not check revocation. It says "unknown" rather than calling an unchecked certificate good. It does show you who issued your certificate, which is the first thing you need to know this week.
Find out from a monitor, not from a customer
TLS Radar keeps a live inventory of every certificate across your domains and checks each one from outside the way a browser does. On Business and Enterprise plans it checks revocation status on every scan, and a revoked certificate drops the grade to F and raises an alert that tells you what to do next.
We also publish a weekly digest of CA compliance incidents drawn from Mozilla's public tracker, so you can watch your CA's record without reading Bugzilla yourself.
Related reading
Frequently asked questions
- Why is GoDaddy revoking 404,607 certificates?
- Because the certificate policy information inside them, such as the policy identifiers and the link to the policy document, did not match what GoDaddy's own published CP/CPS says those certificates contain. The TLS Baseline Requirements say that when a CA learns a certificate was not issued in accordance with its CP/CPS, it must revoke it within five days. Nothing was hacked and no private key was exposed.
- Which GoDaddy certificates are affected?
- GoDaddy listed 404,607 certificates from its GoDaddy R1 OV and EV intermediates, its Starfield R1 DV, OV and EV intermediates, and its Starfield G2 DV, OV and EV intermediates. 396,055 of them are Starfield DV certificates. GoDaddy has not yet said which issue dates are affected; its full incident report is expected to. GoDaddy says it is contacting affected customers by email, text message and phone, and had revoked 227,422 of them by October 19.
- Is a certificate on GoDaddy's list insecure?
- No. The domain names, dates and encryption are not the problem, and the certificate works normally until it is revoked. The defect is that its policy lines do not match GoDaddy's rulebook, which the industry rules treat as misissuance. Once it is revoked it can never become valid again, so it has to be replaced.
- What happens to my site when the certificate is revoked?
- The certificate file on your server does not change, so your server keeps sending it and local checks keep passing. Browsers that check revocation show visitors a full-page security warning instead of your site. Not every browser checks every certificate, so a site can work for some visitors and fail for others.
- How do I find out if my certificate has been revoked?
- You need to check from outside your server, the way a browser does. TLS Radar checks revocation status on every scan on Business and Enterprise plans; a revoked certificate drops the grade to F and raises an alert that names the domain. The free scan does not check revocation and reports it as unknown rather than good, but it does show who issued your certificate.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.