← GoDaddy cases
Bugzilla #2079943
Ca Certificate Compliance
Incident
Self Reported Incident
Certificate Misissuance
Security Incident
GoDaddy issued 54 certificates using a previously compromised private key
ASSIGNED
GoDaddy
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
GoDaddy reported that 54 certificates were issued using public keys associated with a private key that had previously been revoked for key compromise. The bug cites BR 6.1.1.3 #3, which requires a CA to reject a certificate request when it is aware of a demonstrated or proven method exposing the applicant's private key to compromise. GoDaddy says the 54 certificates have been revoked with CRL reason Key Compromise. The company also stated that the mechanism for blocking the compromised key going forward is now functioning properly. GoDaddy said a full investigation is in progress and that a detailed incident report will follow.
Chronology
- GoDaddy issued 54 certificates using public keys associated with a previously compromised private key.
- GoDaddy revoked the 54 certificates with CRL reason Key Compromise.
- GoDaddy confirmed the blocking mechanism for the compromised key was functioning properly.
Thread Activity
- GoDaddy — Opened the bug with a preliminary incident report describing the issuance, the relevant BR requirement, and the revocation/remediation status.
Participants
GoDaddy
External References
Similar Local Cases
GoDaddy: Delayed Certificate Revocation
GoDaddy: CA Certificates with HTTPS URL in AIA Field
GoDaddy: Certificates with invalid embedded SCT signatures
GoDaddy: Subscriber Certificate Profiles Did Not Conform to CP/CPS
GoDaddy: Random Value Vulnerability in Domain Validation Method
GoDaddy: Delayed Revocation of SHA-1 Signed Subordinate CA Certificates
GoDaddy: CA Certificates Published in PEM format
GoDaddy: Revocation process is unusable due to contact address not accepting attachments