GoDaddy: Delayed CRL File Updates
GoDaddy reported an incident where updated CRL files were not publicly published within the required 24-hour timeframe after certificate revocations were recorded. The issue was triggered by a server-level configuration change that severed the ability to sync updated CRL files to the public CRL responders, combined with monitoring that delayed detection. GoDaddy stated that 7,899 certificate revocations were not updated on CRL files within 24 hours, which it identified as a violation of Section 4.9.7 of the Baseline Requirements. GoDaddy corrected the problem by rolling back the configuration change on 2025-02-19 18:40 UTC, and it confirmed that CRL files were synced to public responders by 2025-02-19 19:01 UTC. The incident report also stated that certificate issuance and OCSP responses were unaffected. The bug was resolved as FIXED, with a report closure summary noting remediation steps and that all disclosed action items were completed, pending a final comment window before closure.
- A server-level configuration change was introduced that prevented syncing updated CRL files to CRL responders.
- CRL expiry monitoring failed to alert engineering as expected while CRL files were not being updated on time.
- GoDaddy identified the CRL update issue and rolled back the configuration change to restore syncing of updated CRL files.
- GoDaddy — Reported that GoDaddy identified an issue preventing CRL updates as expected, affecting 7,899 revocations and violating Baseline Requirements Section 4.9.7, and stated the issue was corrected on 2025-02-19 19:01 UTC.
- GoDaddy — Posted the incident report detailing the configuration change, delayed detection, the impact window, and remediation action items.
- GoDaddy — Attached a file listing affected certificates that were revoked.
- Community commenter — Commented that weekly status updates were expected and suggested filing a separate incident report if updates are missing in similar cases.
- GoDaddy — Stated that action items remain complete and that GoDaddy continues monitoring the thread daily.
- Mozilla representative — Suggested filing a closure summary using CCADB incident-report closure guidance.
- GoDaddy — Submitted a report closure summary describing the root cause, remediation, commitment, and stating all action items were completed and requesting closure.
- CCADB representative — Noted this was a final call for comments and that the bug would be closed on approximately 2025-05-08.