← GoDaddy cases
Bugzilla #1904748
Certificate Problem Report
GoDaddy : CAA checks did not properly handle issuewild tag allowing FQDN SANs to be added to wildcard certs
RESOLVED
FIXED
GoDaddy
AI Summary
GoDaddy identified a software bug in its CAA validation process that allowed certificates with the 'issuewild' tag to include Fully Qualified Domain Names (FQDN) as Subject Alternative Names (SANs) on wildcard certificates, violating RFC 8659. This issue was reported on June 23, 2024, and affected 847 active certificates. A fix was implemented, and 843 certificates were revoked on June 28, 2024. GoDaddy has since deployed synthetic monitoring to ensure compliance with CAA records.
Chronology
- GoDaddy received a certificate problem report regarding CAA checks.
- GoDaddy revoked 843 certificates affected by the issue.
- Synthetic monitoring for CAA record detection was deployed.
Participants
star@godaddy.com
pouyan.tehrani@tu-dresden.de
rdaurne77@gmail.com
bwilson@mozilla.com
External References
Similar Local Cases
GoDaddy : CAA checks passed when records contained incorrect variants of godaddy.com or starfieldtech.com
GoDaddy: Intermittent unauthorized OCSP response when certificate is freshly issued
GoDaddy: Domain Validation Reuse Issue
GoDaddy: CRL Issuer Mismatch
ACCV: Delayed revocation of TLS certificates affected by bug #1884532
Entrust: Jurisdiction issue in some EV TLS & Code Signing certificates
GoDaddy: Does not provide a method for domain owners to revoke their certificates
SECOM: Difference in upper and lower case between CN field and SAN