GoDaddy Revokes 404,607 TLS Certificates Over Policy Compliance Failures

GoDaddy revoked 404,607 SSL/TLS certificates issued under its GoDaddy and Starfield hierarchies after discovering that their certificate policy information did not match its published Certificate Policy and Certification Practice Statement (CP/CPS). The discrepancies involved CA-specific policy identifiers and CPS URI policy qualifiers across domain-, organization-, and extended-validation certificates. The incident concerns certificate compliance, not confirmed private-key theft. An updated customer notice says revocation occurred on October 21, after GoDaddy missed the October 18 deadline, creating a separate compliance issue.

GoDaddy temporarily halted certificate issuance, corrected the affected Starfield R1 documentation before resuming issuance, and subsequently corrected inactive G2 profiles. Replacement certificates are being issued, but administrators must verify that replacements are installed and served by every affected endpoint; sites and internal tools still presenting revoked certificates may produce browser warnings or access failures. Administrators on Reddit reported certificate errors affecting internal tools and client certificates. GoDaddy's investigation into the causes, duration, and preventive controls remains ongoing, with a full incident report planned.