GoDaddy delayed CRL updates due to CDN caching of stale CRLs
GoDaddy reported that publicly served CRLs were not being updated within 24 hours after certificates were recorded as revoked. The issue was identified after GoDaddy received a Certificate Problem Report showing revoked certificates first appearing on published CRLs more than 24 hours after revocation. GoDaddy said the CRLs were generated and published to the origin within the required timeframe, but older versions were being served from CDN cache. The company investigated the CDN caching rules, reduced the CRL cache TTL from 24 hours to three hours, cleared the cache, and updated cache-control settings to require revalidation with the origin. The thread states that the incident ended on 2026-10-03 and that no certificate misissuance was involved.
- A CDN cache policy change caused stale CRLs to remain eligible for delivery beyond the origin-defined freshness period.
- Certificates were recorded as revoked and updated CRLs were generated at the origin.
- GoDaddy received a Certificate Problem Report about revoked certificates appearing on public CRLs more than 24 hours after revocation.
- GoDaddy reduced the CRL cache TTL, cleared the CDN cache, and confirmed the updated cache-control settings were taking effect.
- GoDaddy — GoDaddy opened a preliminary incident report describing delayed public CRL availability caused by CDN caching of older CRLs.
- GoDaddy — GoDaddy filed the full incident report, described the timeline and root cause, and stated that the incident ended on 2026-10-03.