GoDaddy: CA Certificates Published in PEM format
This case is a self-disclosed incident by GoDaddy regarding the format of CA certificate files hosted behind the CA Issuers URI (AIA) on issued certificates. GoDaddy reported that two GoDaddy CA certificate files referenced in the AIA CA Issuers URI were being served in PEM format instead of the required DER-encoded format. GoDaddy stated that the non-compliance began on 2025-09-24 and was identified on 2025-12-06, and that it ended on 2025-12-08 after remediation. GoDaddy updated the hosted CA certificate files to the DER format and deployed monitoring to ensure hosted files are DER format for CA Issuer URIs. In the thread, GoDaddy also provided root cause analysis and action items, including updating CA certificate generation procedures to explicitly validate that AIA issuer URLs resolve to the correct DER-encoded CA certificate files and enhancing monitoring using SHA-256 thumbprint validation. GoDaddy requested closure of the incident report, and the bug is marked RESOLVED with resolution FIXED.
- GoDaddy created cross-signed CA certificates with AIA CA Issuers values that later proved to reference CA certificate files hosted in the wrong (PEM) format.
- GoDaddy identified the non-compliance after certificate problem reporting indicated the hosted CA certificate file format issue.
- GoDaddy deployed updated DER-encoded CA files for the affected G2 root certificates behind the CA Issuers URI.
- GoDaddy deployed monitoring for CA Issuer URIs to verify hosted files are DER format.
- GoDaddy reported completion of action items and requested closure of the incident report.
- GoDaddy — GoDaddy opened a preliminary incident report stating that two CA certificate files referenced in issued certificates’ AIA CA Issuers URI were served in PEM format and that the hosted files were updated to DER while investigation continued.
- GoDaddy — GoDaddy posted a full incident report with timeline, impact (2 certificates, 0 remaining valid), root cause analysis, and remediation details, and referenced related bugs including 2004492, 2004492, and others.
- GoDaddy — GoDaddy created an attachment (appendix CSV) for the bug.
- GoDaddy — GoDaddy stated it was continuing to monitor the incident and that remaining action items were still in progress.
- GoDaddy — GoDaddy reported continued monitoring, progress on open action items, and no further update.
- GoDaddy — GoDaddy stated it continued to monitor and was making progress on open action items.
- GoDaddy — GoDaddy said it expected remaining action items to be completed that week.
- GoDaddy — GoDaddy provided an action items update describing procedure and monitoring changes, including DER validation and SHA-256 thumbprint-based monitoring.
- GoDaddy — GoDaddy posted a report closure summary stating remediation was completed, action items were completed, and requested closure.
- CCADB representative — CCADB incident reporting issued a final call for comments and noted the bug would be closed approximately 2026-02-11.