GoDaddy delayed revocation of two SHA-1-signed subordinate CA certificates

ASSIGNED GoDaddy

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

GoDaddy reported that two unexpired SHA-1-signed Subordinate CA Certificates were not revoked by the required 2026-09-15 deadline. The issue was first identified after a Root Store Operator notified GoDaddy, and GoDaddy then investigated the scope of the problem. GoDaddy said it revoked both affected certificates on 2026-09-17 and confirmed no additional affected certificates were found. The report states the incident was caused by GoDaddy overlooking the revocation requirement while focusing on retirement of its legacy SHA-1 root hierarchies. GoDaddy also identified a gap in its process for reviewing and implementing CA/Browser Forum Baseline Requirements changes, and it is updating that procedure as an ongoing action item.

Model: gpt-5.4-mini Generated: 2026-10-20 17:37 UTC Confidence: 0.98 5 comments

Chronology

2026-09-15 Deadline passed for revocation of unexpired SHA-1-signed subordinate CA certificates; two remained unrevoked.
2026-09-17 GoDaddy revoked the two affected subordinate CA certificates.

Thread Activity

2026-09-16 GoDaddy — GoDaddy opened a preliminary incident report saying a Root Store Operator had notified it that two unexpired SHA-1-signed subordinate CA certificates missed the revocation deadline.
2026-09-18 GoDaddy — GoDaddy filed a full incident report, confirmed the two affected certificates, and said both were revoked on 2026-09-17.
2026-09-18 GoDaddy — GoDaddy requested the Next Update field be set to 2026-10-02 for the ballot review procedure action item.
2026-10-02 GoDaddy — GoDaddy said it was still working on the ballot review procedure update and requested the next update be set to 2026-10-16.
2026-10-16 GoDaddy — GoDaddy said it was continuing to make progress on its last action item but had no further update.

Participants

GoDaddy

External References

Original Bugzilla Case

Similar Local Cases

#2082703 UNCONFIRMED Ca Certificate Compliance Incident Externally Reported Incident Policy Document Issue Opened 2026-10-15 Still Open · 90% similar

GoDaddy: Subscriber Certificate Profiles Did Not Conform to CP/CPS

AI Summary CA Owner

#1462844 RESOLVED Self Reported Incident Revocation Issue Opened 2018-05-19 · Closed 2023-02-22 · 81% similar

GoDaddy: Improper DER results in failure to comply with RFC 5280 - Invalid characters in PrintableString

AI Summary CA Owner

#2083191 UNCONFIRMED Ca Certificate Compliance Incident Self Reported Incident Revocation Issue Opened 2026-10-16 Still Open · 80% similar

GoDaddy: Delayed Certificate Revocation

AI Summary CA Owner

#1484766 RESOLVED Self Reported Incident Revocation Issue Security Incident Opened 2018-08-20 · Closed 2024-06-30 · 80% similar

GoDaddy: Random Value Vulnerability in Domain Validation Method

AI Summary CA Owner

#2079943 ASSIGNED Ca Certificate Compliance Incident Self Reported Incident Certificate Misissuance Opened 2026-10-08 Still Open · 78% similar

GoDaddy: Certificate Issuance Using Previously Compromised Private Key

AI Summary CA Owner

#2076246 UNCONFIRMED Ca Certificate Compliance Self Reported Incident Incident Linting Quality Issue Opened 2026-09-28 Still Open · 72% similar

Apple: CRL is signed incorrectly

AI Summary CA Owner

#2081411 ASSIGNED Ca Certificate Compliance Incident Self Reported Incident Repository Issue Opened 2026-10-13 Still Open · 72% similar

Amazon Trust Services: EV Root Test Web Pages Serve Non-EV (DV) Certificates

AI Summary CA Owner

#2075655 ASSIGNED Ca Certificate Compliance Incident Self Reported Incident Revocation Issue Opened 2026-09-25 Still Open · 72% similar

Actalis: Incorrect Revocation dates in CRL entries

AI Summary CA Owner