GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch
› GoDaddy / Starfield TLS certificates (DV, OV, EV)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 14, 2026
- closed
- ongoing
- CVEs
- none
- sources
- 4
## summary
GoDaddy (Starfield) found that 404,607 TLS certificates carried policy information (policy OIDs, CPS URI) that didn't match its own published CP/CPS, which under the CA/Browser Forum Baseline Requirements means they must be revoked within five days. GoDaddy missed the Oct 18 deadline and says the certificates were revoked on Oct 21 2026. Nothing was hacked and no keys leaked, but sites still serving a revoked certificate can show browser warnings or become unreachable until the re-issued certificate is installed.
severity: Compliance mis-issuance, not a compromise; availability impact for sites that haven't installed the replacement certificate
## affected
- 404,607 certificates from Starfield R1/G2 and GoDaddy R1 intermediates (396,055 of them DV from Starfield R1 and G2)
## fixed in
- Re-issued certificates from the GoDaddy SSL dashboard (customer must install them)
## timeline[4]
GoDaddy's customer notice says the incorrectly issued certificates were revoked; affected sites must install the re-issued certificate.
source227,422 of 404,607 certificates revoked as of 05:29 UTC.
sourceFive-day revocation deadline (23:45 UTC) passes with 170,566 certificates revoked; GoDaddy files a delayed-revocation incident.
sourceGoDaddy confirms a third-party report of CP/CPS discrepancies, suspends issuance, fixes its CP/CPS and starts contacting the 404,607 affected subscribers.
source
## advisories[2]
## news & write-ups[1]
## posts[1]
‼️ GoDaddy is revoking 404,607 TLS certificates after a third party flagged that they didn't match its published certificate rules. t.co/SoNFcuNmJj
## notes & caveats
Original mis-issuance bug is Mozilla Bug 2082703; delayed-revocation bug 2083191 promised its next update on Oct 22 2026. Revocation completion date comes from GoDaddy's help page.
