GoDaddy: Document Reuse Issue

GoDaddy reported a document reuse issue affecting certificate issuance. The CA said it identified that, in certain rare cases, its system could misidentify document validity dates when certificates were renewed or rekeyed using documents copied from older certificates, particularly when the activity occurred over multiple years. GoDaddy investigated, derived a list of potentially affected certificates, and finalized that list for revocation. It revoked 471 certificates on 2020-06-05 and instituted an interim process to revoke new certificates with the issue daily until a fix was implemented. GoDaddy said it stopped issuing certificates with this problem as of 2020-06-15 17:15, and that an additional 24 problem certificates were issued between 2020-06-05 19:00 and the system fix. The CA implemented a system fix on 2020-06-15 17:17 and verified that all affected certificates were revoked and that no new certificates were issued with the bug. In follow-up, Mozilla asked for updates on the success of the fix; GoDaddy responded that it completed weekly audits and ran multiple queries confirming the fixes were successful.

1. 2020-06-02 GoDaddy identified the combination of activities leading to misidentification of document validity dates in certain certificate reuse scenarios.
2. 2020-06-03 GoDaddy derived a list of potentially affected certificates and began verification.
3. 2020-06-05 GoDaddy revoked 471 certificates and started an interim daily revocation process for newly issued affected certificates.
4. 2020-06-15 GoDaddy implemented a system fix, stopped issuing affected certificates, and verified all affected certificates were revoked with no new affected issuance.

1. 2020-06-17 GoDaddy — Daniela Hood created the bug describing how GoDaddy discovered the issue, provided a timeline, stated it stopped issuing affected certificates on 2020-06-15 17:15, and reported revocation and the system fix.
2. 2020-06-17 Community commenter — Paul Steinberg questioned whether the attached certificate list contained duplicates and asked how accuracy could be ensured given the duplicates.
3. 2020-06-18 GoDaddy — Daniela Hood replied that duplicates were inserted due to manual collection, uploaded a corrected list, and stated the reconciled totals after removing duplicates.
4. 2020-06-18 Mozilla representative — Ben Wilson asked for a schedule and later requested an update on the success of the fix after implementation.
5. 2020-06-19 GoDaddy — Daniela Hood responded that GoDaddy planned continuous internal review and that the first end-to-end flow internal review would start at the beginning of Q3 and end by end of 2020.
6. 2020-07-23 Mozilla representative — Ben Wilson asked for an update on the relative success since the fix and indicated he intended to close the bug unless there were other questions.
7. 2020-07-23 GoDaddy — Daniela Hood stated that GoDaddy completed weekly audits and executed multiple queries confirming the implemented fixes were successful.