GoDaddy: Failure to revoke certificate with compromised key within 24 hours

GoDaddy faced an issue where a certificate with a compromised key was not revoked within the required 24-hour timeframe. The CA was alerted to the problem via a report on Mozilla's security policy forum. Following an internal investigation, GoDaddy confirmed the certificate was revoked within the stipulated time after confirming the compromise. However, they later acknowledged a misunderstanding of the revocation requirements, leading to updates in their processes. GoDaddy has since implemented a timing matrix to ensure compliance with revocation timelines and has reported additional certificates affected by the same issue.

1. 2020-05-07 Received a certificate problem report indicating a possible key compromise.
2. 2020-05-08 Certificate was revoked due to key compromise.
3. 2020-05-21 Internal analysis concluded the certificate was revoked within 24 hours.
4. 2020-06-03 GoDaddy acknowledged the inquiry and committed to a community response.
5. 2020-09-16 GoDaddy shared a timing matrix to improve compliance with revocation requirements.