GoDaddy Revokes 404,607 SSL Certificates Following Certificate Issuance Error

GoDaddy has revoked 404,607 SSL/TLS certificates after discovering that certain subscriber certificates were issued outside the defined profiles in its Certification Practice Statement (CPS) and Certificate Policy (CP).

The revocation took effect on October 21, 2026, requiring affected customers to obtain and install replacement certificates to avoid browser security warnings and potential website outages. This incident is recorded in Mozilla’s CA Certificate Compliance program under Bug 2082703, which remains active.

GoDaddy Revokes SSL Certificates

The CP/CPS certificate profile issue refers to a mismatch between the technical settings used to issue certificates and the certificate authority’s documented rules.

A Certificate Policy outlines a certificate’s assurance and operational requirements. At the same time, a Certification Practice Statement details how the certificate authority implements them.

Publicly trusted certificate authorities are required to issue certificates that conform to their published CP/CPS documents and the rules set by browser root programs.

If a certificate profile does not comply, for instance, due to an incorrect extension, key-usage setting, validity configuration, or subject-profile requirement, the certificate can be classified as mis-issued, even without evidence of private-key compromise or malicious intent.

GoDaddy has stated that the affected certificates were re-issued; however, customers must ensure that the newly issued certificate is deployed on the relevant web server, load balancer, CDN, or hosting platform.

Websites that continue to present a revoked certificate may trigger certificate-revocation errors in browsers, preventing visitors from securely accessing the service.

This operational impact can be particularly severe for customer portals, e-commerce sites, APIs, email services, VPN gateways, and other internet-facing systems that rely on TLS for encrypted connections.

Administrators can identify the affected certificates through the GoDaddy product portal. By navigating to SSL Certificates and selecting a certificate, customers may see messages such as “Action required: Install your new certificate,” “We couldn’t check your website,” or “This certificate needs your attention.”

In these cases, GoDaddy instructs users to download the replacement certificate via “Download Zip File” or “Download Certificate for Deluxe Automated SSL” and install it on the server. Certificates marked “No action needed” require no customer intervention.

Security teams should treat this event as a certificate-lifecycle issue rather than simply a browser warning. They should inventory all public endpoints, identify any GoDaddy-issued certificates, confirm that replacement certificates and intermediate chains are installed, and validate the live deployment from an external network.

Organizations should also check automated renewal pipelines, reverse proxies, Kubernetes ingress controllers, cloud load balancers, and third-party managed hosting environments, where the certificate may not be stored on the primary application server. GoDaddy’s SSL Status Check tool can assist in validating the current state of a certificate.

This incident underscores the necessity for organizations to implement continuous certificate discovery and automated renewal processes. A valid replacement certificate does not ensure availability until it is deployed to every affected endpoint.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.