GoDaddy self-reported subscriber certificate profile discrepancies against CP/CPS
GoDaddy reported that a third party notified it of discrepancies between subscriber certificate profiles documented in its Public TLS CP/CPS and certificates issued under affected GoDaddy and Starfield TLS hierarchies. The issue involved Certificate Policy information, including CA-specific policy OIDs and CPS URI policy qualifiers, and GoDaddy said affected certificates were issued with Certificate Policy information that did not conform to the documented profiles. GoDaddy said it confirmed the issue, stopped all certificate issuance for the affected R1 hierarchies, updated and republished the CP/CPS to correct the profiles, and then resumed issuance. It also identified similar discrepancies in the Starfield G2 hierarchy and updated and republished that CP/CPS as well. GoDaddy said it initiated its Mass Revocation Procedure and is revoking all affected certificates, and that a full incident report will follow. GoDaddy later noted that a separate bug was filed for the delayed revocation of impacted subscriber certificates.
- A third party reported discrepancies between documented subscriber certificate profiles and issued certificates in the GoDaddy and Starfield TLS hierarchies.
- GoDaddy stopped issuance for the affected R1 hierarchies, updated the CP/CPS, and began mass revocation of affected certificates.
- GoDaddy said a separate bug was filed for delayed revocation of the impacted subscriber certificates.
- GoDaddy — Rob White filed a preliminary incident report describing third-party-reported CP/CPS profile discrepancies, the affected hierarchies, the issuance stop, CP/CPS updates, and the start of mass revocation.
- GoDaddy — Rob White stated that delayed revocation was being tracked in a separate bug, with updates to be provided there.