GoDaddy: Domain Validation Reuse Issue

GoDaddy reported a potential compliance issue discovered during an internal 3% audit involving a specific DV certificate. GoDaddy confirmed that the DV certificate had been validated more than 825 days prior to issuance, and began compliance and engineering work to address the problem. GoDaddy stopped issuing certificates with the problem on 2019-12-18, deployed a patch the same day, and contacted customers to attempt rekeying. GoDaddy worked to identify affected certificates, confirmed affected EV and non-EV SSL certificates, and revoked the affected certificates on 2019-12-20 and 2019-12-21. The thread states that the root cause was program logic that determined domain-validation-reuse timeframes based on time-of-validation to time-of-certificate-request rather than time-of-validation to time-of-certificate-issuance. GoDaddy’s resolution is marked FIXED in the bug status.

1. 2019-12-17 GoDaddy identified a potential DV certificate issue during an internal 3% audit.
2. 2019-12-18 GoDaddy confirmed the DV certificate validation age issue and began remediation, including deploying a patch and revoking the specific certificate.
3. 2019-12-20 GoDaddy revoked lists of affected non-EV SSL certificates and then revoked affected EV SSL certificates after confirming them.
4. 2019-12-21 GoDaddy revoked remaining affected EV SSL certificates.

1. 2019-12-24 GoDaddy — GoDaddy provided an incident report describing how it discovered the issue, the timeline of investigation and remediation, the number of affected certificates, and the stated root cause and prevention steps.
2. 2019-12-24 Fastly representative — Fastly asked GoDaddy to explain more about the root cause and how it was introduced in 2018, and what steps would prevent recurrence.
3. 2019-12-24 GoDaddy — GoDaddy acknowledged the inquiry and said it would provide a response by January 7, 2020 due to holidays.
4. 2020-01-07 GoDaddy — GoDaddy responded with details on the program logic, stated that it could not provide the exact historical team discussion, and described increased diligence and added checks (including a linter check) and a compliance function aligned with development.
5. 2020-05-22 Mozilla representative — Mozilla stated it had no further questions and asked if anyone else had any.