GoDaddy: CCADB CRL disclosure mismatch for G2 intermediates, with G2 issuance now disabled and revocation planned for January 2027
GoDaddy reported a CCADB compliance issue involving a mismatch between the CRL disclosures in CCADB and the CRL URLs listed in issued certificates for its G2 signing intermediates. The issue was first identified after a Certificate Problem Report alerted GoDaddy to the mismatch, and GoDaddy said the problem was a disclosure issue in CCADB rather than certificate misissuance. GoDaddy updated the CCADB entries for one G2 intermediate, published a JSON file with the full partitioned CRL array in its GitHub repository, and said another G2 intermediate remained blocked by CCADB field character limits. Since then, GoDaddy has migrated issuance to its R1 root hierarchy, disabled issuance from the G2 hierarchies on 2026-09-04, and said the last remaining G2 certificate is scheduled to expire in April 2027. GoDaddy stated it will proactively reissue any remaining valid certificates that would extend beyond the planned revocation date and remains on track to revoke the G2 intermediates in January 2027. The bug is still open and the next update was requested for 2026-12-04.
- CCADB Policy 2.0 takes effect, and the CRL disclosure mismatch period begins.
- A Certificate Problem Report alerts GoDaddy to the CRL disclosure mismatch.
- GoDaddy updates R1 signing intermediate CCADB entries with partitioned CRL JSON arrays.
- GoDaddy says one G2 intermediate is now in compliance and another remains blocked by CCADB character limits.
- Issuance from the G2 hierarchies is disabled.
- GoDaddy plans to revoke the G2 intermediates in January 2027.
- GoDaddy — GoDaddy opened a preliminary incident report describing a CRL disclosure mismatch in CCADB and said a full investigation was underway.
- GoDaddy — GoDaddy filed the full incident report, identified the non-compliance as a CCADB Policy 6.2 exact-match issue, and said issuance was not stopped because there was no certificate misissuance.
- CCADB representative — CCADB said the report had gone stale and reminded GoDaddy about the Next update field.
- GoDaddy — GoDaddy said its CCADB policy review was complete, disclosures were up to date, and it was working with two root store programs to remove code signing and S/MIME trust bits from its roots.
- GoDaddy — GoDaddy said it had completed monitoring of CCADB disclosures and now monitors active CA certificates for valid audits, CRL, and CP/CPS disclosures.
- GoDaddy — GoDaddy said one G2 intermediate was brought into compliance, another remained blocked by CCADB character limits, and it intended to revoke the G2 intermediate after unexpired subscriber certificates expired.
- GoDaddy — GoDaddy corrected a typo and stated it planned to revoke the G2 intermediate in January 2027.
- GoDaddy — GoDaddy said it had migrated 99% of issuance to R1, was limiting remaining G2 certificates to 90-day validity, and asked for the next update date to be set to 2026-09-15.
- GoDaddy — GoDaddy said it had migrated 100% of issuance to R1, disabled G2 issuance on 2026-09-04, and would proactively reissue any remaining valid certificates that would extend beyond the planned revocation date.