Has your SSL certificate been revoked?
On 21 October 2026 GoDaddy revoked 404,607 TLS certificates from its GoDaddy and Starfield hierarchies. A website with a revoked certificate may stop loading until the replacement is installed.
We check who issued your certificates, reissue and install the affected ones everywhere they live (load balancer, CDN, mail, apps) and set up automatic renewal so the next revocation is routine.
# Who issued the certificate and when does it expire?$ openssl s_client -connect domain.com:443 -servername domain.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -datesissuer=C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Secure Certificate Authority - G2notBefore=Jun 2 00:00:00 2026 GMTnotAfter=Dec 19 23:59:59 2026 GMT# Issuer GoDaddy, Starfield or eMudhra: check its status in the provider dashboard# Sample output: your domain will show different datesTwo certificate authorities, two different problems
The same week brought a mass revocation over paperwork and a withdrawal of trust over weak keys. In both cases the fix is to change the certificate, and in both cases the certificate usually lives in more places than anyone has written down.
GoDaddy: 404,607 certificates revoked
On 21 October GoDaddy revoked certificates from its GoDaddy and Starfield hierarchies because the policy OIDs and CPS URI they carried did not match its CPS. It is a compliance incident, not a key compromise (Mozilla Bug 2082703).
The consequence is practical: if you do not install the replacement certificate, the website may become unreachable. Source: Cyberpress.
eMudhra: eight intermediate CAs with weak keys
Eight eMudhra intermediate CA certificates, created in April 2025, had weak keys because of a flaw in their key generation ceremony, and the keys were recovered from the public certificates themselves.
Chrome blocked them, Apple on 19 October and Microsoft on the 20th; Go and Node.js shipped an explicit distrust. No attacks against users have been confirmed. Source: The Hacker News.
Issuer and expiry of every certificate
The command at the top of the page returns two values: issuer, who signed the certificate, and notAfter, when it expires. If the issuer contains GoDaddy, Starfield or eMudhra, check the certificate status in the provider dashboard.
Repeat the check on the mail server and on every subdomain with its own certificate (api., app., mail.). It is common for the website to be up to date while mail still runs a certificate from two renewals ago.
# The mail certificate is often a different file on a different machine$ openssl s_client -starttls smtp -connect mail.domain.com:587 </dev/null 2>/dev/null | openssl x509 -noout -issuer -dates# IMAP over direct TLS$ openssl s_client -connect mail.domain.com:993 </dev/null 2>/dev/null | openssl x509 -noout -issuer -datesOne certificate, four places to change it
Before reissuing, we list where it is installed. It is the step most often skipped, and the one behind the second "it's not working" message two days later.
Load balancer or proxy
On AWS ALB, NGINX or HAProxy the certificate is loaded separately from the application server. If TLS terminates there, that is the one browsers see.
CDN
If you uploaded your own certificate to the CDN instead of using the one the provider manages, the new one has to be uploaded by hand or automated through its API.
Mail server
SMTP and IMAP often have their own certificate. If it is revoked, some mail clients and remote servers refuse the connection.
Apps with pinning
If the app pins the key of the certificate or the intermediate, a new certificate can cut it off from the API until a new version is released.
From revocation to automatic renewal
Order matters: first get everything working again, then make sure it does not depend on someone remembering.
- 01
Issuer and scope
We list domains and subdomains, pull the issuer and expiry of each certificate and flag the ones that depend on GoDaddy, Starfield or eMudhra.
- 02
Reissue and install
We request the replacement certificate (or a new one from another CA if switching suits you) and install the full chain, with the right intermediate.
- 03
Every endpoint
Load balancer, CDN, mail, staging environments and apps with pinning. We check each one from the outside with openssl, not just in the dashboard.
- 04
Automatic renewal
We set up ACME with Let's Encrypt or with the CA you use, so renewal and deployment to every endpoint happen without anyone stepping in.
- 05
Expiry alerts
A periodic check that warns when a certificate is close to expiring or when its issuer changes without anyone asking for it.
Certificates that renew themselves
In 2025 the CA/Browser Forum passed ballot SC-081: the maximum validity has been 200 days since 15 March 2026, drops to 100 days in March 2027 and to 47 days in March 2029. With those limits, manual renewal stops being a yearly chore and becomes an almost monthly one.
- Someone remembers the date, generates the request and uploads it to the dashboard
- The new file is copied to the server, but not to the CDN or the mail server
- Since 15 March 2026 a certificate lasts at most 200 days: two renewals a year per domain
- If the CA revokes, the whole process has to be repeated in a hurry
- An ACME client (certbot, your load balancer's or your CDN's) requests and renews on its own
- Every place the certificate lives is listed and gets deployed in the same step
- When the maximum drops to 100 days (2027) and 47 (2029), nothing changes in your operations
- An alert fires if a renewal fails, before the certificate expires
Has your website, mail or app stopped connecting?
Write to us →FAQ about revoked SSL certificates
How do I know if my certificate is one of the 404,607 GoDaddy revoked?
Has data been stolen if my certificate is revoked?
Is reissuing the certificate on the web server enough?
What about a mobile app that does certificate pinning?
Is Let's Encrypt fine for a business?
Send us your list of domains
With your domains and subdomains we tell you which certificates depend on an affected CA and where each one is installed. Then you decide whether we change them.
Tell us your challenge. We'll propose a solution.
No commitment. Within 24 hours, you'll receive a proposal with scope, timeline and budget. No fine print.