GoDaddy: Expired CRLs

GoDaddy reported an incident involving expired Certificate Revocation Lists (CRLs) that occurred on June 3, 2020. The issue was identified after a customer inquiry prompted an investigation, revealing that the CRLs had not been updated due to a failure in the migration process to a new environment. GoDaddy took immediate action by regenerating and publishing new CRLs on June 4, 2020. The CA has since improved its procedures for system transitions and is migrating the CRL generation process to a clustered environment to prevent future occurrences. The case has been resolved with the implementation of these corrective measures.

1. 2020-06-03 CRLs expired
2. 2020-06-04 New CRLs published

1. 2020-06-15 GoDaddy — GoDaddy explains the timeline and actions taken regarding the expired CRLs.
2. 2020-06-15 Community commenter — Concerns raised about the lack of detail in the incident report.
3. 2020-06-19 GoDaddy — Response detailing the standard procedures followed during the incident.
4. 2020-07-30 GoDaddy — GoDaddy outlines its disaster recovery procedures but declines to disclose specifics for security reasons.
5. 2020-11-23 GoDaddy — Attached a sanitized excerpt from the operations guide related to disaster recovery.
6. 2020-12-03 Mozilla representative — Reviewed the Disaster Recovery Guide and indicated no further questions.