GoDaddy 404 607 ta SSL/TLS sertifikatini bekor qildi, chunki ba'zi abonent sertifikatlari uning Sertifikatlash Amaliyot Bayonoti (CPS) va Sertifikat Siyosati (CP) da belgilangan profillardan tashqarida berilganligi aniqlandi.
Bekor qilish 2026-yil 21-oktabrda kuchga kirdi va ta'sirlangan mijozlar brauzer xavfsizlik ogohlantirishlari va mumkin bo'lgan veb-sayt uzilishlaridan qochish uchun almashtirish sertifikatlarini olish va o'rnatishlari kerak. Ushbu hodisa Mozilla CA Sertifikat Muvofiqlik dasturi doirasida Bug 2082703 ostida qayd etilgan va u hali ham faol.
CP/CPS sertifikat profili muammosi sertifikatlarni berish uchun ishlatilgan texnik sozlamalar va sertifikat beruvchi organining hujjatlashtirilgan qoidalari o'rtasidagi nomuvofiqlikni anglatadi.
Sertifikat Siyosati sertifikatning kafolat va operatsion talablarini belgilaydi. Sertifikatlash Amaliyot Bayonoti esa sertifikat beruvchi organ ularni qanday amalga oshirishini batafsil bayon qiladi.
Ommaviy ishonchli sertifikat beruvchi organlar o'zlarining e'lon qilingan CP/CPS hujjatlariga va brauzer ildiz dasturlari tomonidan belgilangan qoidalarga mos sertifikatlar berishlari shart.
Agar sertifikat profili mos kelmasa, masalan, noto'g'ri kengaytma, kalit-foydalanish sozlamasi, amal qilish konfiguratsiyasi yoki subyekt-profil talabi tufayli, sertifikat shaxsiy kalit buzilishi yoki yomon niyat dalili bo'lmasa ham, noto'g'ri berilgan deb tasniflanishi mumkin.
GoDaddy ta'sirlangan sertifikatlar qayta berilganini ma'lum qildi; ammo mijozlar yangi berilgan sertifikat tegishli veb-server, yuk balanslagich, CDN yoki hosting platformasida o'rnatilganligiga ishonch hosil qilishlari kerak.
Bekor qilingan sertifikatni taqdim etishda davom etadigan veb-saytlar brauzerlarda sertifikat bekor qilish xatolarini keltirib chiqarishi mumkin, bu esa tashrif buyuruvchilarning xizmatga xavfsiz kirishiga to'sqinlik qiladi.
Ushbu operatsion ta'sir mijoz portallari, elektron tijorat saytlari, API'lar, elektron pochta xizmatlari, VPN shlyuzlari va shifrlangan ulanishlar uchun TLS ga tayanadigan boshqa internetga yo'naltirilgan tizimlar uchun ayniqsa jiddiy bo'lishi mumkin.
Administratorlar ta'sirlangan sertifikatlarni GoDaddy mahsulot portali orqali aniqlashlari mumkin. SSL Sertifikatlari bo'limiga o'tib va sertifikatni tanlab, mijozlar "Harakat talab qilinadi: Yangi sertifikatingizni o'rnating", "Biz veb-saytingizni tekshira olmadik" yoki "Ushbu sertifikat sizning e'tiboringizni talab qiladi" kabi xabarlarni ko'rishlari mumkin.
Bunday hollarda GoDaddy foydalanuvchilarga "Zip faylini yuklab olish" yoki "Deluxe Avtomatlashtirilgan SSL uchun sertifikatni yuklab olish" orqali almashtirish sertifikatini yuklab olish va uni serverga o'rnatish bo'yicha ko'rsatma beradi. "Hech qanday harakat talab qilinmaydi" deb belgilangan sertifikatlar mijoz aralashuvini talab qilmaydi.
Xavfsizlik jamoalari ushbu hodisani faqat brauzer ogohlantirishi emas, balki sertifikat hayot sikli masalasi sifatida ko'rishlari kerak. Ular barcha ommaviy nuqtalarni inventarizatsiya qilishlari, GoDaddy tomonidan berilgan har qanday sertifikatni aniqlashlari, almashtirish sertifikatlari va oraliq zanjirlar o'rnatilganligini tasdiqlashlari va jonli o'rnatishni tashqi tarmoqdan tekshirishlari kerak.
Tashkilotlar shuningdek, avtomatlashtirilgan yangilash quvurlari, teskari proksi-serverlar, Kubernetes kirish nazoratchilari, bulut yuk balanslagichlari va uchinchi tomon boshqariladigan hosting muhitlarini tekshirishlari kerak, chunki sertifikat asosiy ilova serverida saqlanmasligi mumkin. GoDaddy SSL Holat Tekshirish vositasi sertifikatning joriy holatini tekshirishda yordam berishi mumkin.
Ushbu hodisa tashkilotlar uchun uzluksiz sertifikat aniqlash va avtomatlashtirilgan yangilash jarayonlarini joriy etish zarurligini ta'kidlaydi. Yaroqli almashtirish sertifikati har bir ta'sirlangan nuqtaga o'rnatilmaguncha mavjudlikni kafolatlamaydi.
GoDaddy has revoked 404,607 SSL/TLS certificates after discovering that certain subscriber certificates were issued outside the defined profiles in its Certification Practice Statement (CPS) and Certificate Policy (CP).
The revocation took effect on October 21, 2026, requiring affected customers to obtain and install replacement certificates to avoid browser security warnings and potential website outages. This incident is recorded in Mozilla’s CA Certificate Compliance program under Bug 2082703, which remains active.
The CP/CPS certificate profile issue refers to a mismatch between the technical settings used to issue certificates and the certificate authority’s documented rules.
A Certificate Policy outlines a certificate’s assurance and operational requirements. At the same time, a Certification Practice Statement details how the certificate authority implements them.
Publicly trusted certificate authorities are required to issue certificates that conform to their published CP/CPS documents and the rules set by browser root programs.
If a certificate profile does not comply, for instance, due to an incorrect extension, key-usage setting, validity configuration, or subject-profile requirement, the certificate can be classified as mis-issued, even without evidence of private-key compromise or malicious intent.
GoDaddy has stated thatthe affected certificates were re-issued; however, customers must ensure that the newly issued certificate is deployed on the relevant web server, load balancer, CDN, or hosting platform.
Websites that continue to present a revoked certificate may trigger certificate-revocation errors in browsers, preventing visitors from securely accessing the service.
This operational impact can be particularly severe for customer portals, e-commerce sites, APIs, email services, VPN gateways, and other internet-facing systems that rely onTLS for encrypted connections.
Administrators can identify the affected certificates through the GoDaddy product portal. By navigating to SSL Certificates and selecting a certificate, customers may see messages such as “Action required: Install your new certificate,” “We couldn’t check your website,” or “This certificate needs your attention.”
In these cases, GoDaddy instructs users to download the replacement certificate via “Download Zip File” or “Download Certificate for Deluxe Automated SSL” and install it on the server. Certificates marked “No action needed” require no customer intervention.
Security teams should treat this event as a certificate-lifecycle issue rather than simply a browser warning. They should inventory all public endpoints, identify any GoDaddy-issued certificates, confirm that replacement certificates and intermediate chains are installed, and validate the live deployment from an external network.
Organizations should also check automated renewal pipelines, reverse proxies, Kubernetes ingress controllers, cloud load balancers, and third-party managed hosting environments, where the certificate may not be stored on the primary application server. GoDaddy’s SSL Status Check tool can assist in validating the current state of a certificate.
This incident underscores the necessity for organizations to implement continuous certificate discovery and automated renewal processes. A valid replacement certificate does not ensure availability until it is deployed to every affected endpoint.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.