GoDaddy Pulls Over 400,000 SSL Certificates Over Policy Violations, Including Gibraltar Government Sites

GoDaddy, one of the world’s largest domain registrars and SSL certificate providers, announced the revocation of 404,607 SSL/TLS certificates after discovering violations of its internal certificate‑policy rules. The mass revocation, disclosed in a notice to affected customers, also impacted a handful of public‑facing websites operated by the government of Gibraltar.

The certificates in question were issued over a period of several years and were found to contain errors that conflicted with GoDaddy’s compliance standards. While the company did not detail the specific nature of the policy breaches, such errors can include mismatched domain names, incorrect validation data, or failure to meet industry‑wide baseline security requirements. When a certificate does not meet these criteria, it can no longer guarantee the encrypted connection it promises, prompting providers like GoDaddy to withdraw it.

Revoking more than 400,000 certificates is an uncommon move for a commercial certificate authority, and it underscores the growing emphasis on rigorous validation in the public‑key infrastructure (PKI) ecosystem. SSL/TLS certificates are the cornerstone of secure web traffic, enabling browsers to verify that they are communicating with the intended site and not an impostor. When a certificate is revoked, browsers and other clients that rely on certificate revocation lists (CRLs) or the Online Certificate Status Protocol (OCSP) will flag the site as insecure, potentially causing visitors to see warning messages or be blocked altogether.

For website operators, the revocation notice means they must replace the invalidated certificates promptly to restore trust and avoid service disruptions. GoDaddy has offered a streamlined re‑issuance process, allowing customers to generate new certificates that comply with current policies. The company also advised administrators to check their server configurations and ensure that any cached revocation data is refreshed, so that browsers recognize the newly issued certificates without delay.

The inclusion of Gibraltar government sites in the revocation list has drawn particular attention, as public sector portals are expected to uphold the highest security standards. Local officials were briefed on the situation and are reportedly working with GoDaddy to obtain compliant certificates and mitigate any temporary loss of confidence among citizens accessing online services.

Industry observers note that the incident may prompt other certificate authorities to audit their own inventories more aggressively. As cyber threats evolve and regulatory frameworks tighten, the margin for error in digital certificate management continues to shrink. Stakeholders are likely to monitor how GoDaddy’s remediation efforts unfold and whether similar large‑scale revocations become a more regular feature of the PKI landscape.