GoDaddy misses deadline to revoke 404,607 mis-profiled TLS certificates

GoDaddy misses deadline to revoke 404,607 mis-profiled TLS certificates

19 October 2026: GoDaddy is revoking 404,607 TLS certificates issued under its Starfield and GoDaddy hierarchies because their certificate policy fields did not match the profiles in its published certification practice statement, and it has told the browser root programmes it could not finish within the five days the industry rules allow. Site owners whose certificates are on the list have to reissue and install replacements before the old ones are revoked, or their sites and APIs will fail validation.

A paperwork error with a hard deadline

The incident report GoDaddy filed with Mozilla on 15 October says a third party reported discrepancies between the subscriber certificate profiles in the Starfield Technologies public TLS CP/CPS and the certificates actually issued, involving CA-specific policy OIDs and CPS URI qualifiers. GoDaddy stopped all issuance, found further discrepancies in its own review, published a corrected CP/CPS and resumed issuance. The G2 hierarchy, which no longer issues, needed only the document fix.

Nothing in the report suggests the certificates are cryptographically weak. Under the CA/Browser Forum Baseline Requirements, though, a certificate not issued in line with the CA's own policy must be revoked within five days, which is what turned a documentation slip into a mass replacement.

Where the affected certificates sit

Hierarchy	Certificates
Starfield R1 DV	208,896
Starfield G2 DV	187,159
GoDaddy R1 OV	4,041
Starfield G2 OV	2,134
GoDaddy R1 EV	1,141
Starfield R1 OV	928
Starfield G2 EV	199
Starfield R1 EV	109

Almost all are domain-validated certificates, the kind sold with hosting plans and renewed in the background, which is why many owners will not know they hold one. GoDaddy brands outside the US are affected too; heise reports that Host Europe and DomainFactory customers in Germany were given until 21 October to replace theirs.

Late, and saying so

GoDaddy says it began contacting subscribers on 14 October, including high-volume, government, financial and healthcare customers, by email, SMS and phone. In a second bug filed on 16 October it reported in advance that revocation would be late. Its update of 19 October says 170,566 certificates were revoked by the deadline of 18 October at 23:45 UTC and 227,422 by 05:29 UTC on 19 October, leaving about 177,000 still valid at that point, and that dedicated teams are working on outreach, replacement and revocation.

Owners should check the issuer of every certificate in use, not only those bought directly: a Starfield or GoDaddy issuer on a certificate dated before mid-October means a reissue is due, and certificates pinned in mobile apps or installed on appliances will need manual work. Where GoDaddy cannot replace a certificate automatically, the owner has to request it.

Update, 23 October 2026: GoDaddy reported at 22:59 UTC on 22 October that it had completed revocation of all certificates affected by the incident, about four days after the deadline. Its corrected count is 403,643 affected certificates rather than 404,607: 378,067 were revoked and 25,576 expired, leaving none valid. It did not say why the total fell by 964.

Related on TrustList:

• Arc browser stops working on 22 December; new accounts closed now

Sources

• Mozilla Bugzilla 2082703: GoDaddy, Subscriber Certificate Profiles Did Not Conform to CP/CPS, 15 October 2026
• Mozilla Bugzilla 2083191: GoDaddy, delayed revocation (update of 19 October), 19 October 2026
• heise online: GoDaddy widerruft Hunderttausende Zertifikate aufgrund formaler Fehler, 22 October 2026
• Mozilla Bugzilla 2083191: GoDaddy, delayed revocation (update of 22 October) - 22 October 2026