GoDaddy Revokes More Than 400,000 SSL Certificates Following Compliance Error

GoDaddy Revokes More Than 400,000 SSL Certificates Following Compliance Error

By Nerd of Fortune

Website owners and IT administrators are being urged to review their overpriced SSL certificates after GoDaddy revoked hundreds of thousands of certificates that were found to have been issued incorrectly due to a certificate compliance issue. The incident has affected a total of 404,607 SSL/TLS certificates across both the GoDaddy and Starfield certificate hierarchies.

According to GoDaddy’s customer advisory, the mass revocation took place on October 21, 2026. Organizations that have not yet installed replacement certificates could experience website outages, browser security warnings, or service disruptions for their visitors.

The issue is currently under investigation through Mozilla’s CA Certificate Compliance program and is being tracked as Bug 2082703.

Host With SiteGround And Avoid GoDaddy High SSL Fees

Compliance Issue Triggers Massive Certificate Revocation

The problem was not related to a cybersecurity breach, stolen certificates, or compromised encryption keys. Instead, investigators discovered discrepancies between issued subscriber certificates and the certificate profiles documented in GoDaddy’s public TLS Certificate Policy and Certification Practice Statement (CP/CPS).

The discrepancies involved certificate policy information, including Certificate Authority-specific Object Identifiers (OIDs) and Certification Practice Statement Uniform Resource Identifier (URI) policy qualifiers. These technical elements help define how certificates are issued and validated within the public trust ecosystem.

A third-party researcher initially identified several inconsistencies affecting multiple certificate profiles. After confirming the findings, GoDaddy temporarily suspended certificate issuance while it conducted an internal review.

During that review, engineers discovered additional mismatches beyond those originally reported, leading to a broader investigation into certificate issuance practices and policy documentation.

Starfield and GoDaddy Certificates Impacted

GoDaddy stated that the largest share of affected certificates came from its Starfield certificate authorities.

The breakdown includes:

• 208,896 Starfield R1 Domain Validation (DV) certificates
• 187,159 Starfield G2 Domain Validation (DV) certificates
• Thousands of additional Organization Validation (OV) and Extended Validation (EV) certificates across both GoDaddy and Starfield infrastructures

Starfield G2 certificates were particularly notable because that hierarchy was no longer actively issuing certificates, yet historical discrepancies were still discovered during the review process.

After identifying the issue, GoDaddy updated the affected R1 certificate profiles within its published policies and resumed certificate issuance. However, subsequent analysis revealed that similar documentation and profile mismatches extended into the legacy Starfield G2 environment as well.

Investigation Continues

GoDaddy has announced that its investigation remains ongoing as the company works to determine:

• How the discrepancies were introduced
• How long the inconsistencies remained undetected
• Whether additional certificate profiles were affected
• What safeguards can be implemented to prevent future divergence between policy documentation, issuance configurations, and actively issued certificates

The company has emphasized that the incident is a compliance matter rather than a security compromise. There is currently no indication that customer data, private keys, or encrypted communications were exposed as a result of the issue.

Revocation Deadline Concerns

In a related disclosure, GoDaddy acknowledged that certificate revocation activity exceeded the compliance timeline typically required under industry standards.

Company records indicate that approximately 170,566 affected certificates had been revoked by October 18 at 23:45 UTC. That number increased to 227,422 certificates by October 19 at 05:29 UTC.

However, GoDaddy’s later customer notification confirmed that the broader revocation effort continued through October 21, ultimately impacting more than 400,000 certificates.

The timing has drawn attention because certificate authorities are generally expected to meet strict revocation deadlines when improperly issued certificates are discovered.

Website Owners Must Install Replacement Certificates

GoDaddy has already reissued replacement certificates for affected customers. However, merely having a replacement certificate available in a hosting account is not enough. So, not only does GoDaddy overcharge for their SSL’s, GoDaddy is forcing customers to fix GoDaddy’s screw-ups (BIG surprise there huh?).

Administrators must actively install the new certificate on the server serving website traffic. Any website that continues using a revoked certificate may trigger browser security warnings, HTTPS connection errors, or complete accessibility issues for visitors.

Customers are advised to:

1. Log in to their GoDaddy account.
2. Open the SSL Certificates management section.
3. Review all active certificates.
4. Look for alerts indicating action is required.
5. Download and install the replacement certificate on the affected server.

Common warnings displayed within customer accounts may include messages indicating that a new certificate requires installation, that GoDaddy could not verify certificate status, or that administrator attention is needed.

Immediate Priority: Verify the Live Certificate

One of the most important takeaways from the incident is that reissuance alone does not guarantee protection from disruptions.

Organizations should verify that their public-facing websites are actively serving the newly issued certificate rather than the revoked version. Failure to complete deployment could result in downtime, trust warnings, and customer access issues even though a replacement certificate has already been generated.

GoDaddy also recommends using certificate verification tools to confirm the currently deployed certificate status.

For businesses relying on HTTPS for e-commerce, customer portals, online services, and public websites, ensuring that replacement certificates have been properly installed should be considered an immediate operational priority.

As the investigation continues, the incident serves as another reminder of the critical role certificate lifecycle management plays in maintaining trust across the modern internet.

Nerd of Fortune (a former GoDaddy employee, by the way) is definitely NOT surprised at GoDaddy’s (or NoDaddy) screw up in this case. The Nerd was fed up with GoDaddy’s overcharging for basic help and support so decided to start his OWN company: Nerd of Fortune, more than 10 years ago. So, visit The Nerd if you want exceptional service at low prices. Also, The Nerd recommends SiteGround for all your website HOSTING needs. 

Websites deserve security without the hassle. That’s why SiteGround includes free SSL certificates for all customers, making it easy to protect your visitors and build trust from day one. Combine that with lightning-fast servers, advanced security features, and exceptional uptime, and you have everything needed to power a modern website. Stop worrying about certificates and start focusing on what matters most. Choose SiteGround for hosting that’s secure, fast, reliable, and built to help your website thrive.