GoDaddy Revokes 378,067 Certificates After Policy Mismatch

GoDaddy has closed a policy mismatch affecting 403,643 TLS certificates, revoking 378,067 while 25,576 expired before revocation, after the company missed a five-day deadline and left affected sites at risk of browser blocks.

The final total was revised down from an initial 404,607. The certificates carried policy fields that did not match the published certificate policy and certification practice statement (CP/CPS) for GoDaddy’s Starfield Technologies certificate operation. The affected inventory included GoDaddy and Starfield certificates across eight groups.

Under baseline requirements, a CA should revoke certificates that do not follow its own policy within 24 hours and must revoke them within five days. GoDaddy had revoked 170,566 certificates, about 42%, by its deadline of 7:45 p.m. ET on Oct. 18 (23:45 UTC).

Browser response can vary. Firefox desktop version 137 and later checks a local list of revoked certificates that refreshes every 12 hours, while Chrome relies on CRLSets that contain only a subset. GoDaddy said a full incident report will explain why the policy documents and issued certificates diverged, how long the issue lasted and what steps will prevent a repeat.