Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorymedium

GoDaddy finishes revoking 404,607 noncompliant TLS certificates

2 sources · 2 articlesFirst reported Updated ()
What's new

October 22: Reports detail the missed October 18 deadline (170,566 revoked), 227,422 revoked by October 19, completion on October 21, chain counts, and no confirmed key theft.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

GoDaddy completed revocation of 404,607 mis-issued TLS certificates on October 21; sites still serving them may fail browser checks.

GoDaddy revoked 404,607 SSL/TLS certificates issued under GoDaddy and Starfield chains because they did not match published certificate profiles, including policy OIDs and CPS URI qualifiers. A third party flagged the mismatch; GoDaddy paused issuance, corrected documentation, and later found similar issues on the older Starfield G2 chain. Only 170,566 certificates were revoked when the October 18 deadline passed; by 05:29 UTC on October 19, 227,422 had been revoked, and a later notice says revocation finished on October 21. Reports describe a compliance failure, not confirmed private-key theft. Customers must install replacements; a replacement in the account does not mean the site is serving it. Mozilla tracks the case as Bug 2082703, which remains active.

Key facts
  • Starfield R1 DV accounted for 208,896 certificates; Starfield G2 DV for 187,159.
  • Baseline Requirements called for revocation within five days, reason “superseded.”
  • Outreach began October 14 and included government, financial, and health customers.
  • Administrators can check the GoDaddy SSL portal and SSL Status Check tool.
  • Certificates marked “No action needed” require no customer action.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 14, 2026GoDaddy began customer outreach on affected certificates. · Cyber Security News
  2. Oct 18, 2026Deadline passed with 170,566 certificates revoked. · Cyber Security News
  3. Oct 19, 2026By 05:29 UTC, 227,422 certificates had been revoked. · Cyber Security News
  4. Oct 21, 2026GoDaddy finished revoking the 404,607 certificates. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsRevocation counts by deadline, chain totals, and outreach scope.
  • GBHackersMozilla Bug 2082703 and portal messages for customer action.
Vendors
GoDaddy
Products
StarfieldGoDaddy SSL/TLS certificates
Organizations
Mozilla

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Cyber Security NewsFirst report

    GoDaddy revokes 404,607 TLS certificates after policy mismatch

    Revocation finished on October 21 after a missed deadline; reports describe no confirmed private-key theft.

  2. · 3d ago GBHackers

    GoDaddy revokes 404,607 SSL certificates after profile mismatch

    Revocation took effect October 21, 2026, and sites still serving those certificates can fail browser TLS checks.