GoDaddy revokes 404,607 TLS certificates after policy mismatch
Original title: GoDaddy Revoking 404,607 TLS Certificates Following Compliance Failures
Revocation finished on October 21 after a missed deadline; reports describe no confirmed private-key theft.
GoDaddy revoked 404,607 SSL/TLS certificates issued under GoDaddy and Starfield chains because they did not match published certificate profiles, including policy OIDs and CPS URI qualifiers. A third party flagged the mismatch; GoDaddy paused issuance, corrected documentation, and later found similar issues on the older Starfield G2 chain. Only 170,566 certificates were revoked when the October 18 deadline passed, and a later notice says the incorrectly issued certificates were revoked on October 21. Customers still serving an old certificate may see browser warnings until a replacement is installed.
Unconfirmed: The reports describe a compliance failure, not a confirmed theft of private keys.
- Starfield R1 DV accounted for 208,896 certificates and Starfield G2 DV for 187,159.
- Baseline Requirements called for revocation within five days, reason "superseded."
- By 05:29 UTC on October 19, 227,422 certificates had been revoked.
- Outreach began October 14 and included government, financial, and health customers.
- A replacement in the account does not mean the site is serving it.
Impact: Sites may show browser warnings until replacement certificates are installed
| Product | Affected |
|---|---|
| GoDaddy SSL/TLS certificates | 404,607 certificates under GoDaddy and Starfield chains |
- 1.Review the SSL certificate section of the GoDaddy account and install any replacement.
- 2.Confirm the domain is serving the new certificate, not only that it exists in the account.
From the original article
2 min read at cybersecuritynews.com
GoDaddy launched a mass revocation of 404,607 SSL/TLS certificates after finding that issued certificates did not match its published certificate policies. The company missed its required revocation deadline, creating a second compliance issue. An updated customer notice says the incorrectly issued certificates were revoked on October 21, 2026.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.