Skip to content
Hookgap
Get started

GoDaddy certificate revocations: what happened and what to check

· 5 min read

Part of the guide Website security headers explained for small business sites.

When a certificate authority (CA) revokes a certificate, it withdraws the certificate before its expiry date. Browsers that check revocation then refuse the certificate, and visitors see a security warning until the site gets a new one. CAs revoke certificates that were issued by mistake or whose private key may have been exposed, and the rules for doing so are set out in the CA/Browser Forum baseline requirements.

What happened in 2017

In 2017 GoDaddy revoked about 8,951 certificates. A code bug had left some domain validation files missing, so GoDaddy could not confirm that the customers still controlled the domains. The certificates had been issued without proper validation, so they were revoked. The story was reported by SecurityWeek and PCWorld that year.

What is happening in 2026

A Mozilla bug report (Bugzilla bug 2072663) concerns two unexpired intermediate CA certificates from GoDaddy that still use SHA-1 signatures. According to the bug, the CA/Browser Forum deadline to revoke them was 15 September 2026. GoDaddy planned to revoke both on 17 September 2026 and was reviewing whether other certificates were affected. The bug was still open when we checked, so read it for the final outcome.

This is an action on the CA's own certificates. Whether any customer certificate is affected depends on what the review finds, so check the bug for updates rather than relying on this summary.

How to check a client site

  1. Check the issuer. A Hookgap report shows the certificate's issuer, issue and expiry dates and covered names in the SSL certificate section.
  2. Check the status. Open the site in a browser and view the certificate. Hookgap flags a revoked certificate as a critical finding when the certificate data shows revocation.
  3. Replace it if needed. Ask the hosting provider or CA for a new certificate. Sites on platforms that renew automatically normally receive one without any action.
  4. Automate renewal. Certificate lifetimes are getting shorter, so set up automated renewal where the platform supports it. See the 47-day schedule.

What to tell the client

Keep the explanation plain. The certificate was withdrawn and needs replacing, and the site is being checked. A revocation is not, by itself, evidence of an attack on the business or its visitors. If the browser warning is still showing after a new certificate is installed, check that the new certificate is actually served, including on any subdomains.

A CAA record limits which certificate authorities can issue for the domain. It does not stop an existing certificate from being revoked, but it does help control future issuance. See CAA records explained.

Frequently asked questions

How do I know if my GoDaddy certificate has been revoked?

Open the site in a browser and look at the certificate details, or run a certificate check. A browser warning that the certificate is revoked means it must be replaced. If you are not sure, ask the hosting provider to confirm the status.

Do I have to pay for a new certificate after a revocation?

Not always. Many hosts and automated certificate authorities issue a replacement at no extra cost. Ask your provider whether reissuing your certificate costs anything before you buy one.

Does a revoked certificate mean the website was hacked?

Not by itself. Revocations usually concern how a certificate was issued or the certificate authority's own compliance. Treat a revocation as a certificate problem to fix, and check the site for other changes if something else looks wrong.

Keep reading

More on website security