GoDaddy : CAA checks passed when records contained incorrect variants of godaddy.com or starfieldtech.com

RESOLVED FIXED GoDaddy

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

GoDaddy identified a compliance issue related to CAA record checks after receiving a certificate problem report on June 23, 2024. The investigation revealed a software bug that allowed CAA validation to pass with incorrect record values that did not conform to RFC 8659. This misissuance affected 168 active certificates, prompting GoDaddy to revoke them on June 28, 2024, after deploying a fix on June 26. A full incident report was promised by July 5, 2024, and synthetic monitoring tests have since been implemented to prevent future occurrences.

Model: gpt-4o-mini Generated: 2026-06-13 21:33 UTC Revised: 2026-06-16 18:51 UTC Confidence: 0.85 11 comments

Chronology

2024-06-23 GoDaddy received a certificate problem report regarding CAA checks.
2024-06-26 GoDaddy deployed a fix for the CAA validation bug.
2024-06-28 GoDaddy revoked 168 active certificates affected by the issue.
2024-09-03 Synthetic monitoring for CAA records was deployed.

Thread Activity

2024-06-26 GoDaddy — GoDaddy reported a software bug in the CAA process that allowed incorrect validation.
2024-07-04 GoDaddy — GoDaddy confirmed that they did not stop issuance during the bug resolution process.
2024-08-27 GoDaddy — GoDaddy provided an update on the implementation of synthetic monitor tests.
2024-09-20 GoDaddy — GoDaddy confirmed that all action items related to the incident have been completed.

Participants

GoDaddy Tu-dresden representative Community commenter Mozilla representative

External References

Original Bugzilla Case www.rfc-editor.org certs.godaddy.com bugzilla.mozilla.org

Similar Local Cases

#1969296 RESOLVED Ca Certificate Compliance Certificate Misissuance Closure Request Opened 2025-05-29 · Closed 2025-07-22 · 91% similar

GoDaddy: Certificates with invalid embedded SCT signatures

AI Summary CA Owner

#1963456 RESOLVED Ca Certificate Compliance Certificate Misissuance Closure Request Opened 2025-04-29 · Closed 2025-07-25 · 87% similar

GoDaddy: CA Certificates with HTTPS URL in AIA Field

AI Summary CA Owner

#1904748 RESOLVED Certificate Misissuance Opened 2024-06-26 · Closed 2024-10-31 · 86% similar

GoDaddy : CAA checks did not properly handle issuewild tag allowing FQDN SANs to be added to wildcard certs

AI Summary CA Owner

#1921254 RESOLVED Certificate Misissuance Self Reported Incident Opened 2024-09-26 · Closed 2025-02-19 · 77% similar

Izenpe: Duplicate attribute in Subject

AI Summary CA Owner

#1896108 RESOLVED Self Reported Incident Certificate Misissuance Opened 2024-05-10 · Closed 2024-09-06 · 75% similar

Telia: Certificates Issued with lower case value in subject:countryName

AI Summary CA Owner

#1887096 RESOLVED Ca Certificate Compliance Certificate Misissuance Closure Request Opened 2024-03-22 · Closed 2024-09-06 · 75% similar

Chunghwa Telecom: Wrong Extended Key Usage setting by GTLSCA

AI Summary CA Owner

#1910322 RESOLVED Certificate Misissuance Revocation Issue Opened 2024-07-29 · Closed 2025-06-18 · 74% similar

DigiCert: Random value in CNAME without underscore prefix

AI Summary CA Owner

#1897346 RESOLVED Certificate Misissuance Revocation Issue Opened 2024-05-17 · Closed 2024-07-24 · 74% similar

SECOM: Difference in upper and lower case between CN field and SAN

AI Summary CA Owner