GoDaddy Revokes 404,607 SSL Certificates Over Policy Mismatch

If your site runs a GoDaddy SSL certificate revoked on October 21, the clock is already running. GoDaddy and its Starfield certificate arm revoked 404,607 TLS certificates after a third party found that some of them did not match the company’s published certificate policy, according to GBHackers and Hackread. A revoked certificate is a blunt instrument. Browsers can refuse the connection, so a site that still presents the old certificate can break for visitors.

The sources describe a compliance and documentation failure, not confirmed theft of private keys. That distinction matters most to regulators and to the company’s own compliance staff. For a site operator, the fix is the same either way: install a replacement certificate on every system that serves the domain.

What GoDaddy revoked and why

Public TLS certificates are issued under rules set by the certificate authority’s published policy and by browser root programs. A certificate that does not conform to those rules can be revoked, and revocation forces the site operator to swap in a new one. This action follows that mechanism.

Hackread reports that some subscriber certificates had been issued outside the profiles described in GoDaddy’s Certification Practice Statement and Certificate Policy. The mismatch involved certificate policy object identifiers and CPS URI qualifiers, the fields that point to the documented practices behind a certificate, as The Daily Tech Feed explains. A third party flagged the problem.

GoDaddy then suspended issuance during the investigation, corrected its published documentation and resumed issuing certificates, according to Bregg. The revocation took effect on October 21, 2026. It is tracked as Mozilla CA Certificate Compliance Bug 2082703, which remained active in the sources reviewed.

Which GoDaddy and Starfield certificates are affected

Domain-validation certificates make up most of the set. A domain-validation certificate confirms control of a domain name. Organization and extended-validation certificates, which also check the business behind the name, were a much smaller group. Hackread’s breakdown shows where the 404,607 certificates fall:

Taken together, domain-validation certificates account for roughly 98 percent of the total. That is a broad blast radius for ordinary websites, not just specialized enterprise setups.

A further review also found similar discrepancies in Starfield’s older G2 hierarchy, which had already stopped issuing new certificates, according to Hackread and Bregg. The sources do not say whether those findings change the affected count.

Impact is not limited to commercial sites. Hackread reports that some Gibraltar government websites were affected. The reporting does not yet include a confirmed count of US government or healthcare sites, which is the number American readers most need.

The missed October 18 deadline and the 24-hour rule

GoDaddy began contacting affected customers on October 14. Its revocation deadline arrived on October 18 at 23:45 UTC, and by then 170,566 certificates had been revoked, according to Mallory. The effort did not finish on time. A later customer notice update reported 227,422 certificates revoked by 05:29 UTC. A separate Mozilla bug, 2083191, covers the delayed revocation.

Several reports cite 404,607 as the number revoked, but the timestamped figures from the deadline and the customer update do not match that total. None of the coverage confirms a final tally.

Coverage also cites a baseline rule that affected certificates should be revoked within 24 hours and must be revoked within 5 days, subject to exceptions. A repost of GoDaddy coverage lays out that rule. Measured against it, a revocation that ran past its own deadline is the most serious operational lapse in the record so far.

How to replace a revoked GoDaddy SSL certificate

Cyberpress reports that affected customers must obtain and install replacement certificates on their servers, load balancers, CDNs or hosting platforms to avoid browser security warnings and potential outages. Here is the practical sequence:

• Log in to your GoDaddy account and open the SSL certificate section.
• Look for an “install your new certificate” prompt or a similar notice on each affected domain.
• Download the replacement certificate from the account.
• Install it on every server, load balancer, CDN and hosting platform that serves the domain, including any APIs, email services and VPN gateways that use it.
• Confirm the live site serves the new certificate. Issuing a replacement in the account does not by itself fix a live site.

After installation, load the site in a private browser window and inspect the certificate details. If a hosting provider manages certificates for you, ask it directly whether the replacement has been deployed rather than assuming automation handled it.

Consumers have little direct action. If a major site suddenly shows a certificate warning, avoid entering passwords or payment details until the warning clears. Use the company’s official app or published contact details rather than a link from an email or message.

Why this is a compliance failure, not a key breach

A key compromise and a policy mismatch call for different responses. A compromised key raises the risk of impersonation and calls for key rotation and an investigation into who had access. A policy mismatch means the certificates were issued in ways the published rules did not describe, so revocation is the remedy. That is less alarming on paper, but a site that breaks is just as disrupted.

USA 24 has covered a separate problem this month at eMudhra, a certificate authority with a key compromise and related browser blocks. Bregg treats the two events as examples of certificate-trust stress in the same week, and its healthcare-focused checklist is useful for any organization running patient-facing sites.

The winners and losers are fairly clear. Organizations with automated renewal, a current certificate inventory and staff who can deploy quickly may see only a brief disruption, if any. Smaller businesses, municipal sites and teams that install certificates by hand carry most of the risk. GoDaddy absorbs the reputational cost, and browser programs gain a clear example of strict enforcement.

What to watch next

Several open questions will decide how large this story becomes:

• Whether the final revocation count reaches 404,607 and how many sites actually broke.
• How Mozilla handles bug 2082703 and the delayed-revocation bug 2083191, and whether browser root programs take further action.
• Whether the older Starfield G2 review expands the affected set.
• Whether US government or healthcare sites report disruption.

The clearest signal will come from the Mozilla bug trackers and from site owners’ own monitoring. If a browser refuses a connection to a domain you run, that is the moment to check the certificate chain and confirm the replacement is live before a customer finds the problem first.