GoDaddy: inconsistent CP/CPS disclosure metadata in CCADB
This case reports an inconsistency in GoDaddy’s CCADB metadata for an intermediate certificate. Andrew Ayer noted that for the intermediate with fingerprint 7a43bc7747d0633fbd90ff900c9242417c027dbdca05af72da9a70e3518dbe2e, GoDaddy disclosed CP/CPS as the same as the parent in CCADB record 001TO00000WaSbGYAV, but the parent record 001TO00000WaH9aYAF did not have a CP/CPS value and instead used an MD/AsciiDoc CP/CPS field. Andrew stated this inconsistency prevents programmatic determination of the intermediate’s CP/CPS. GoDaddy investigated and updated the applicable intermediate records in CCADB by unchecking “CP/CPS Same as Parent” and checking “MD/AsciiDoc CP/CPS Same as Parent.” GoDaddy also stated that the CP/CPS itself was already correctly disclosed and publicly available via the parent record, and that the issue was limited to metadata consistency and did not affect policy disclosure or compliance requirements. GoDaddy requested the bug be marked invalid and resolved, and the bug status is RESOLVED with resolution INVALID.
- Andrew Ayer reported a CCADB metadata inconsistency for a GoDaddy intermediate’s CP/CPS disclosure relative to its parent record.
- GoDaddy updated CCADB metadata for applicable intermediate records to correct the CP/CPS/MD-AsciiDoc CP/CPS “same as parent” settings.
- GoDaddy asked that the bug be marked invalid and resolved after remediation and monitoring.
- Mm representative — Reported that an intermediate record indicated CP/CPS was the same as parent, but the parent record lacked CP/CPS and used MD/AsciiDoc CP/CPS instead, making CP/CPS determination programmatically impossible.
- GoDaddy — Acknowledged the inconsistency and said GoDaddy CA was investigating and would take appropriate action shortly.
- GoDaddy — Confirmed GoDaddy fixed the CCADB metadata inconsistency by updating intermediate records’ “CP/CPS Same as Parent” and “MD/AsciiDoc CP/CPS Same as Parent” flags, and stated the CP/CPS was already correctly disclosed via the parent record.
- GoDaddy — Stated GoDaddy would continue monitoring and suggested marking the bug invalid and resolved if no further questions/comments.