GoDaddy: Issued EV Wildcard Certificate

GoDaddy discovered that it had issued an Extended Validation (EV) wildcard certificate on September 16, 2021, which violated the CA/B Forum guidelines. The issue was identified by a Registration Authority specialist on September 20, 2021, leading to an immediate investigation and subsequent revocation of the certificate on September 21, 2021. GoDaddy implemented a systematic fix to prevent future issuance of EV wildcard certificates, including disabling the functionality that allowed such requests. The CA also updated its training and audit processes to reinforce compliance with EV certificate issuance guidelines. The case has been resolved with all mitigation strategies completed.

1. 2021-09-16 GoDaddy issued an EV wildcard certificate.
2. 2021-09-20 GoDaddy discovered the issuance during routine processing.
3. 2021-09-21 The EV wildcard certificate was revoked.

1. 2021-09-22 GoDaddy — GoDaddy reported the incident and outlined the discovery and response timeline.
2. 2021-09-28 GoDaddy — GoDaddy provided updates on mitigation strategies and training completed.
3. 2021-10-20 GoDaddy — GoDaddy confirmed that all mitigation strategies have been completed.
4. 2021-10-26 Mozilla representative — Scheduled closure of the bug.