← GoDaddy cases
Bugzilla #1969296
Ca Certificate Compliance
Certificate Misissuance
Closure Request
GoDaddy: Certificates with invalid embedded SCT signatures
RESOLVED
FIXED
GoDaddy
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
GoDaddy reported an incident involving two subscriber certificates that contained invalid embedded Signed Certificate Timestamp (SCT) signatures. The issue was identified on May 22, 2025, following a report received through certificate problem reporting. Both certificates were revoked by May 24, 2025. GoDaddy conducted an investigation and determined that the invalid SCTs were due to insufficient validation of SCT responses from a Certificate Transparency log. As a corrective measure, GoDaddy implemented a patch to verify SCTs before inclusion in final certificates and added monitoring for invalid SCT signatures. All action items related to the incident have been completed, and GoDaddy has requested closure of the case.
Chronology
- GoDaddy identifies invalid SCT signatures in two subscriber certificates.
- Both impacted certificates are revoked.
- GoDaddy submits closure report for the incident.
Thread Activity
- GoDaddy — Initial report of the incident regarding invalid SCT signatures.
- GoDaddy — Full incident report detailing the investigation and findings.
- GoDaddy — Closure report submitted, detailing remediation actions taken.
Participants
GoDaddy
CCADB representative
Community commenter
Mm representative
External References
Similar Local Cases
GoDaddy: CA Certificates with HTTPS URL in AIA Field
GoDaddy : CAA checks passed when records contained incorrect variants of godaddy.com or starfieldtech.com
Netlock: unspecifed revocation code (0) in CRL
Financijska agencija (Fina): Mis-issued certificates
TunTrust: SSL OV mis-issuance against CP/CPS (Email attribute)
SSL.com: DCV bypass and issue fake certificates for any MX hostname
D-Trust: Missed Revocation of TLS certificates affected by Bugzilla 1884714
Certigna: Multiple Reserved Certificate Policy Identifiers in CA certificates