# GoDaddy Revokes 404,607 SSL Certificates Over Policy Mismatch

- URL: https://usa-24.com/godaddy-ssl-certificates-revoked/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-25T12:01:46.531Z
- Updated: 2026-10-25T12:01:46.538Z
- Topics: SSL Certificates, GoDaddy, TLS Security, Certificate Revocation, Web Security

> GoDaddy and its Starfield arm revoked 404,607 TLS certificates on October 21 after a third party found they broke the published policy. Sites without replacements risk browser warnings.

## Key takeaways

- GoDaddy and its Starfield certificate arm revoked 404,607 TLS certificates effective October 21, 2026, after a third party found they did not match the company's published certificate policy.
- Domain-validation certificates made up most of the set, including 208,896 Starfield R1 DV and 187,159 Starfield G2 DV certificates.
- GoDaddy missed its October 18 revocation deadline, when 170,566 certificates had been revoked, and a later customer notice update cited 227,422 by 05:29 UTC.
- Affected site owners must install replacement certificates on every server, load balancer, CDN or hosting platform, or visitors may see browser warnings.
- The reporting describes a compliance and documentation failure, not confirmed theft of private keys.

If your site runs a GoDaddy SSL certificate revoked on October 21, the clock is already running. GoDaddy and its Starfield certificate arm revoked 404,607 TLS certificates after a third party found that some of them did not match the company’s published certificate policy, according to [GBHackers](https://gbhackers.com/godaddy-revokes-404607-ssl-certificates/) and [Hackread](https://hackread.com/godaddy-revokes-ssl-certificates-policy-errors/). A revoked certificate is a blunt instrument. Browsers can refuse the connection, so a site that still presents the old certificate can break for visitors.

The sources describe a compliance and documentation failure, not confirmed theft of private keys. That distinction matters most to regulators and to the company’s own compliance staff. For a site operator, the fix is the same either way: install a replacement certificate on every system that serves the domain.

## What GoDaddy revoked and why

Public TLS certificates are issued under rules set by the certificate authority’s published policy and by browser root programs. A certificate that does not conform to those rules can be revoked, and revocation forces the site operator to swap in a new one. This action follows that mechanism.

Hackread reports that some subscriber certificates had been issued outside the profiles described in GoDaddy’s Certification Practice Statement and Certificate Policy. The mismatch involved certificate policy object identifiers and CPS URI qualifiers, the fields that point to the documented practices behind a certificate, as [The Daily Tech Feed](https://thedailytechfeed.com/godaddy-pulls-nearly-405k-tls-certs-over-policy-misalignment/) explains. A third party flagged the problem.

GoDaddy then suspended issuance during the investigation, corrected its published documentation and resumed issuing certificates, according to [Bregg](https://bregg.com/blog/emudhra-ca-compromise-godaddy-ssl-revocation-healthcare-2026-10-22). The revocation took effect on October 21, 2026. It is tracked as Mozilla CA Certificate Compliance Bug 2082703, which remained active in the sources reviewed.

## Which GoDaddy and Starfield certificates are affected

Domain-validation certificates make up most of the set. A domain-validation certificate confirms control of a domain name. Organization and extended-validation certificates, which also check the business behind the name, were a much smaller group. Hackread’s breakdown shows where the 404,607 certificates fall:

| Certificate group | Revoked |
|---|---|
| Starfield R1 domain validation (DV) | 208,896 |
| Starfield G2 DV | 187,159 |
| Other organization and extended validation (OV and EV) | 8,552 |
| Total | 404,607 |

Taken together, domain-validation certificates account for roughly 98 percent of the total. That is a broad blast radius for ordinary websites, not just specialized enterprise setups.

A further review also found similar discrepancies in Starfield’s older G2 hierarchy, which had already stopped issuing new certificates, according to Hackread and Bregg. The sources do not say whether those findings change the affected count.

Impact is not limited to commercial sites. Hackread reports that some Gibraltar government websites were affected. The reporting does not yet include a confirmed count of US government or healthcare sites, which is the number American readers most need.

## The missed October 18 deadline and the 24-hour rule

GoDaddy began contacting affected customers on October 14. Its revocation deadline arrived on October 18 at 23:45 UTC, and by then 170,566 certificates had been revoked, according to [Mallory](https://mallory.ai/stories/01a16169-67c7-7731-a12f-82d953f043f3). The effort did not finish on time. A later customer notice update reported 227,422 certificates revoked by 05:29 UTC. A separate Mozilla bug, 2083191, covers the delayed revocation.

Several reports cite 404,607 as the number revoked, but the timestamped figures from the deadline and the customer update do not match that total. None of the coverage confirms a final tally.

Coverage also cites a baseline rule that affected certificates should be revoked within 24 hours and must be revoked within 5 days, subject to exceptions. A [repost of GoDaddy coverage](https://blog.aimactgrow.com/godaddy-revokes-404607-ssl-certificates-after-coverage-errors/) lays out that rule. Measured against it, a revocation that ran past its own deadline is the most serious operational lapse in the record so far.

## How to replace a revoked GoDaddy SSL certificate

[Cyberpress](https://cyberpress.org/godaddy-revokes-over-400000-ssl-certificates/) reports that affected customers must obtain and install replacement certificates on their servers, load balancers, CDNs or hosting platforms to avoid browser security warnings and potential outages. Here is the practical sequence:

- Log in to your GoDaddy account and open the SSL certificate section.
- Look for an “install your new certificate” prompt or a similar notice on each affected domain.
- Download the replacement certificate from the account.
- Install it on every server, load balancer, CDN and hosting platform that serves the domain, including any APIs, email services and VPN gateways that use it.
- Confirm the live site serves the new certificate. Issuing a replacement in the account does not by itself fix a live site.

After installation, load the site in a private browser window and inspect the certificate details. If a hosting provider manages certificates for you, ask it directly whether the replacement has been deployed rather than assuming automation handled it.

Consumers have little direct action. If a major site suddenly shows a certificate warning, avoid entering passwords or payment details until the warning clears. Use the company’s official app or published contact details rather than a link from an email or message.

## Why this is a compliance failure, not a key breach

A key compromise and a policy mismatch call for different responses. A compromised key raises the risk of impersonation and calls for key rotation and an investigation into who had access. A policy mismatch means the certificates were issued in ways the published rules did not describe, so revocation is the remedy. That is less alarming on paper, but a site that breaks is just as disrupted.

USA 24 has covered a separate problem this month at eMudhra, a certificate authority with a key compromise and related browser blocks. Bregg treats the two events as examples of certificate-trust stress in the same week, and its healthcare-focused checklist is useful for any organization running patient-facing sites.

The winners and losers are fairly clear. Organizations with automated renewal, a current certificate inventory and staff who can deploy quickly may see only a brief disruption, if any. Smaller businesses, municipal sites and teams that install certificates by hand carry most of the risk. GoDaddy absorbs the reputational cost, and browser programs gain a clear example of strict enforcement.

## What to watch next

Several open questions will decide how large this story becomes:

- Whether the final revocation count reaches 404,607 and how many sites actually broke.
- How Mozilla handles bug 2082703 and the delayed-revocation bug 2083191, and whether browser root programs take further action.
- Whether the older Starfield G2 review expands the affected set.
- Whether US government or healthcare sites report disruption.

The clearest signal will come from the Mozilla bug trackers and from site owners’ own monitoring. If a browser refuses a connection to a domain you run, that is the moment to check the certificate chain and confirm the replacement is live before a customer finds the problem first.

## Frequently asked questions

### How do I check whether my GoDaddy SSL certificate was revoked?

Log in to your GoDaddy account and open the SSL certificate section for each domain you own. Look for an “install your new certificate” prompt or a similar notice. The coverage does not describe a public lookup tool, so the account itself is the most reliable place to check.

### Will my website go down if I do nothing?

Not necessarily, but the risk is real. Once a certificate is revoked, browsers can refuse connections to a site that still presents it, which can produce security warnings or outages for visitors. Cyberpress reports that affected customers must install replacements to avoid those warnings and potential outages.

### Did GoDaddy suffer a private key breach?

The sources describe a compliance and documentation failure rather than confirmed theft of private keys. The issue was that some certificates were issued outside the profiles in GoDaddy’s published Certification Practice Statement and Certificate Policy. The fix for site owners is still to install a replacement certificate.

### What is Mozilla bug 2082703?

Mozilla CA Certificate Compliance Bug 2082703 is the tracking record for this GoDaddy and Starfield issue, and it remained active in the sources reviewed. A separate Mozilla bug, 2083191, covers the delayed revocation after GoDaddy missed its October 18 deadline.

## Sources

1. [GoDaddy Revokes 404,607 SSL Certificates Following Certificate Issuance Error (GBHackers)](https://gbhackers.com/godaddy-revokes-404607-ssl-certificates/)
2. [GoDaddy Revokes 404,607 SSL Certificates After Policy Errors (Hackread)](https://hackread.com/godaddy-revokes-ssl-certificates-policy-errors/)
3. [GoDaddy Revokes 404,607 TLS Certificates Over Policy Compliance Failures (Mallory)](https://mallory.ai/stories/01a16169-67c7-7731-a12f-82d953f043f3)
4. [GoDaddy Revokes Over 400,000 SSL Certificates, Putting Websites at Risk of Outages (Cyberpress)](https://cyberpress.org/godaddy-revokes-over-400000-ssl-certificates/)
5. [Two SSL/TLS Trust Failures This Week: What Healthcare Organizations Need to Check (Bregg)](https://bregg.com/blog/emudhra-ca-compromise-godaddy-ssl-revocation-healthcare-2026-10-22)
6. [GoDaddy Pulls Nearly 405K TLS Certs Over Policy Misalignment (The Daily Tech Feed)](https://thedailytechfeed.com/godaddy-pulls-nearly-405k-tls-certs-over-policy-misalignment/)
7. [GoDaddy Revokes 404,607 SSL Certificates After Coverage Errors (blog repost)](https://blog.aimactgrow.com/godaddy-revokes-404607-ssl-certificates-after-coverage-errors/)