2072663 - GoDaddy: Delayed Revocation of SHA-1 Signed Subordinate CA Certificates

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Rob White]

Steps to reproduce:

Preliminary Incident Report

Summary

• Incident description: GoDaddy was notified by a Root Store Operator that two unexpired SHA-1 signed Subordinate CA Certificates had not been revoked by the required September 15, 2026 deadline.

• Relevant policies: CA/Browser Forum TLS Baseline Requirements §7.1.3.2.1: "Prior to 2026‐09‐15, the CA SHALL revoke any unexpired Subordinate CA Certificate that contains RSASSA-PKCS1-v1_5 with SHA-1 within the Certificate."

• Source of incident disclosure: Third-party reported

GoDaddy plans to revoke the two affected certificates on September 17, 2026 and is reviewing to determine whether any additional certificates are affected. GoDaddy is investigating the root cause, and a full incident report will follow.

Comment 1

[Rob White]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000028
• Incident description: GoDaddy was notified by a Root Store Operator that two unexpired SHA-1 signed Subordinate CA Certificates had not been revoked by the required September 15, 2026 deadline.
• Timeline summary:
   - Non-compliance start date: 2026-09-15
   - Non-compliance identified date: 2026-09-15
   - Non-compliance end date: 2026-09-17
• Relevant policies: CA/Browser Forum TLS Baseline Requirements §7.1.3.2.1:

“Prior to 2026‐09‐15, the CA SHALL revoke any unexpired Subordinate CA Certificate that contains RSASSA-PKCS1-v1_5 with SHA-1 within the Certificate.”

• Source of incident disclosure: Third-party reported

Impact

• Total number of certificates: 2
• Total number of "remaining valid" certificates: 0 following revocation on September 17, 2026
• Affected certificate types: Subordinate CA Certificates
• Incident heuristic: Unexpired and unrevoked GoDaddy Subordinate CA Certificates containing RSASSA-PKCS1-v1_5 with SHA-1 within the Certificate as of September 15, 2026. The full corpus of affected certificates is disclosed in the Appendix.
• Was issuance stopped in response to this incident, and why or why not?: No. The affected certificates are legacy Subordinate CA Certificates associated with GoDaddy's G1 hierarchies and have not been used for certificate issuance for several years.
• Analysis: The two affected certificates were required to be revoked prior to September 15, 2026. Following notification from a Root Store Operator, GoDaddy reviewed its CA certificate population to identify any additional certificates subject to the requirement that had not been revoked. GoDaddy confirmed the two certificates disclosed in this report represented the entire affected population and scheduled both certificates for revocation on September 17, 2026.
• Additional considerations: N/A

Timeline

All dates are UTC.

Date (UTC)	Description
2026-01-09	Discussion period for Ballot SC-097 began.
2026-01-14	GoDaddy reviewed and discussed Ballot SC-097.
2026-01-23	Voting period for Ballot SC-097 concluded.
2026-02-24	Ballot SC-097 was adopted into TLS Baseline Requirements version 2.2.5.
2026-08-26	GoDaddy discussed its approach for retiring the legacy G1 root hierarchies, including pursuing removal of the roots from the remaining Root Store Operators in which they were trusted.
2026-09-08	GoDaddy contacted the remaining two Root Store Operators in which the legacy G1 roots were trusted to request removal of those roots from their respective root stores.
2026-09-15 00:00:00	The deadline for revocation of unexpired Subordinate CA Certificates containing RSASSA-PKCS1-v1_5 with SHA-1 passed. The two affected certificates remained unexpired and unrevoked. Incident begins.
2026-09-16 00:35	GoDaddy received notification from a Root Store Operator identifying the two affected certificates.
2026-09-16 15:42	GoDaddy investigated the affected certificates and the scope of the issue.
2026-09-16 21:10	GoDaddy reviewed its CA certificate population to determine whether any additional certificates subject to the requirement had not been revoked and determined there were no others.
2026-09-17 17:58:59	GoDaddy revoked both affected certificates. Incident ends.

Related Incidents

None identified.

Root Cause Analysis

The fundamental failure in this incident was that GoDaddy overlooked the requirement to revoke the two affected legacy Subordinate CA Certificates prior to September 15, 2026.
GoDaddy was aware of the SHA-1 deprecation changes and had been working toward the retirement and removal of its remaining legacy SHA-1 root hierarchies. At the time, two major browser Root Store Operators had already distrusted the affected legacy root hierarchies. GoDaddy's implementation efforts therefore focused on obtaining removal of those legacy root hierarchies from the remaining major browser Root Store Operators.
As a result of this focus, GoDaddy did not separately identify the two unexpired Subordinate CA Certificates associated with these hierarchies as requiring affirmative revocation prior to September 15, 2026.
The incident also identified a gap in GoDaddy's process for reviewing and implementing changes to the CA/Browser Forum Baseline Requirements. While the requirements introduced by the ballot were reviewed and discussed, GoDaddy's process did not ensure that each applicable requirement was mapped to the complete population of affected certificates and independently verified before its compliance deadline.

Contributing Factor 1: Incomplete scope of the SHA-1 deprecation implementation

• Description: GoDaddy's implementation efforts focused on the retirement and removal of the legacy SHA-1 root hierarchies from the remaining Root Store Operators in which they were trusted. The two affected Subordinate CA Certificates were associated with these legacy hierarchies. As a result, the requirement to affirmatively revoke these two certificates prior to September 15, 2026 was overlooked.
• Timeline: This condition arose during GoDaddy's review and implementation of the SHA-1 deprecation requirements and continued through the September 15, 2026 revocation deadline.
• Detection: GoDaddy identified this contributing factor during its investigation following notification from a Root Store Operator. It was not detected because GoDaddy’s implementation activities were focused on removal of the legacy root hierarchies rather than a reconciliation of the requirement against the complete CA certificate population.
• Interaction with other factors: The scope issue was not identified before the deadline because the ballot review process did not require an independent verification of the complete certificate population affected by each applicable requirement.
• Root Cause Analysis methodology used: 5 Whys.

Contributing Factor 2: Ballot review process did not sufficiently validate implementation against all requirements

• Description: GoDaddy reviews CA/Browser Forum ballots to identify new and changing compliance requirements. Although the requirements introduced by this ballot were reviewed and discussed, GoDaddy’s process did not include a sufficiently structured step requiring each applicable requirement to be mapped to affected systems and certificate populations, assigned an implementation action, and independently verified before the applicable compliance date.
• Timeline: The ballot review process was in place when SC-097 was adopted and remained in place through the September 15, 2026 compliance deadline.
• Detection: GoDaddy identified this process gap during its root cause analysis of this incident.
• Interaction with other factors: Because the process did not require each applicable requirement to be independently reconciled against the affected certificate population, the focus on legacy root hierarchy removal described in Contributing Factor 1 was not identified as incomplete before the compliance deadline.
• Root Cause Analysis methodology used: 5 Whys.

Lessons Learned

• What went well: Once notified by the Root Store Operator, GoDaddy promptly investigated the issue, identified the affected certificates, initiated a review of its CA certificate population to determine whether additional certificates were affected, and initiated revocation of the affected certificates.
• What didn't go well: GoDaddy's implementation of the SHA-1 deprecation changes focused on removal of the legacy root hierarchies and overlooked the separate requirement to revoke the two affected Subordinate CA Certificates. Additionally, GoDaddy's ballot review process did not include a sufficiently structured mechanism to map each applicable requirement to the complete affected certificate population and verify implementation before the compliance deadline.
• Where we got lucky: The affected certificates were not being used for certificate issuance and were scheduled to expire on November 16, 2026.
• Additional: When the interpretation or implementation of a new or changing requirement is unclear, GoDaddy identified the need to seek additional input before finalizing its implementation approach, including, as appropriate, consultation with its auditors or the applicable CA/Browser Forum working group or committee.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Complete review of GoDaddy CA certificates for applicability of the SHA-1 revocation requirement	DETECT	Root Cause 1	GoDaddy's CA certificate population has been reviewed against the requirement and no other affected certificates were identified	2026-09-16	Complete
Revoke the two affected SHA-1 signed Subordinate CA Certificates	MITIGATE	Root Cause 1	Both affected certificates are revoked and their revocation status is publicly available	2026-09-17	Complete
Update CA/Browser Forum ballot review procedure	PREVENT	Root Cause 1, 2	The documented ballot review procedure is updated to require applicable requirements to be mapped to affected systems and/or certificate populations, compliance dates, required implementation actions, responsible owners, and verification of completion, and escalation where applicability or implementation expectations require additional review or confirmation.	2026-10-02	Ongoing

Appendix

Precertificate SHA-256 hash	Certificate SHA-256 hash	Subject	Issuer	Not before	Not after	Serial #	dNSNames	Is revoked?	Revocation date	Revocation reason	crt.sh
-	09ED6E991FC3273D8FEA317D339C02041861973549CFA6E1558F411F11211AA3	serialNumber=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O=GoDaddy.com, Inc., L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O=The Go Daddy Group, Inc., C=US	Nov 16 01:54:37 2006 GMT	Nov 16 01:54:37 2026 GMT	0x301	-	Yes	Sep 17 17:58:59 2026 GMT	Cessation Of Operation	https://crt.sh/?id=40
-	05A6DB389391DF92E0BE93FDFA4DB1E3CF53903918B8D9D85A9C396CB55DF030	serialNumber=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O=Starfield Technologies, Inc., L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O=Starfield Technologies, Inc., C=US	Nov 16 01:15:40 2006 GMT	Nov 16 01:15:40 2026 GMT	0x201	-	Yes	Sep 17 17:58:59 2026 GMT	Cessation Of Operation	https://crt.sh/?id=28

Comment 2

[Rob White]

We request the Next Update field be set to 2026-10-02 for an update on our action item of 'Update CA/Browser Forum ballot review procedure'. Thank you.

Comment 3

[Rob White]

GoDaddy has made good progress on the Update CA/Browser Forum ballot review procedure action item, including the monitoring capabilities being developed as part of this process. We are taking additional time to ensure the monitoring is accurately capturing the appropriate information from CA/Browser Forum ballots. We have updated the due date for this action item to 2026-10-30.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Complete review of GoDaddy CA certificates for applicability of the SHA-1 revocation requirement	DETECT	Root Cause 1	GoDaddy's CA certificate population has been reviewed against the requirement and no other affected certificates were identified	2026-09-16	Complete
Revoke the two affected SHA-1 signed Subordinate CA Certificates	MITIGATE	Root Cause 1	Both affected certificates are revoked and their revocation status is publicly available	2026-09-17	Complete
Update CA/Browser Forum ballot review procedure	PREVENT	Root Cause 1, 2	The documented ballot review procedure is updated to require applicable requirements to be mapped to affected systems and/or certificate populations, compliance dates, required implementation actions, responsible owners, and verification of completion, and escalation where applicability or implementation expectations require additional review or confirmation.	2026-10-30	Ongoing

GoDaddy CA continues to monitor this thread for questions. We request the Next Update field be set to 2026-10-16 for an update on this action item. Thank you.