Certificate revocationFri, 23 Oct 2026
GoDaddy SSL certificate revocation: deploy replacements and verify live services
GoDaddy revoked a batch of affected SSL certificates on October 21, 2026 after a CP/CPS certificate profile issue led to incorrect issuance. Services still presenting a revoked certificate may show warnings or fail to connect, affecting transactions, sign-ins and API integrations.
Article
GoDaddy revoked a batch of affected SSL certificates on October 21, 2026 after a CP/CPS certificate profile issue led to incorrect issuance. Services still presenting a revoked certificate may show warnings or fail to connect, affecting transactions, sign-ins and API integrations.
- 01
Incorrectly issued certificate is revoked
- 02
A TLS endpoint still serves the old certificate
- 03
Clients may warn or reject the connection
- Inventory GoDaddy-managed certificates across CDNs, load balancers, reverse proxies, standby nodes and managed hosting. Follow the notification for each certificate.
- “Install your new certificate” means reissuance is complete and the site still serves the old certificate. “We couldn’t check your website” leaves verification outstanding. Follow the per-certificate instructions for “No action needed.”
- Ask providers for the installed serial number, installation time and verification result for each endpoint. Test HTTPS, SNI, the complete chain, failover, TLS pinning and older clients. Keep TLS certificate validation enabled.
- 01
Confirm the notification
Use the established GoDaddy sign-in page and review the notification for each certificate.
- 02
Obtain replacement certificates
Download the reissued certificate or follow the replacement procedure for the product.
See what to doResources: 1
TWISA member solutions
Obtain replacement certificates
Download the reissued certificate or follow the replacement procedure for the product.
- 03
Deploy to all TLS endpoints
Install the replacement and full chain at every TLS termination point and reload the service as required.
See what to doResources: 1
TWISA member solutions
Deploy to all TLS endpoints
Install the replacement and full chain at every TLS termination point and reload the service as required.
- 04
Verify and monitor
Verify the serial number, expiry and chain. Test login, payment, APIs and failover.
See what to doResources: 2
TWISA member solutions
Verify and monitor
Verify the serial number, expiry and chain. Test login, payment, APIs and failover.
Allow authorized traffic and apply controls at each layer.
- 01
Confirm the notification
Use the established GoDaddy sign-in page and review the notification for each certificate.
- 02
Obtain replacement certificates
Download the reissued certificate or follow the replacement procedure for the product.
- 03
Deploy to all TLS endpoints
Install the replacement and full chain at every TLS termination point and reload the service as required.
Feed logs and traffic data from each layer into monitoring and response.
- Verify and monitorVerify the serial number, expiry and chain. Test login, payment, APIs and failover.
TWISA member solutions
Obtain replacement certificates → Obtain a server certificate
Use a supported certificate and chain for the service.
Deploy to all TLS endpoints → Automate and manage certificate deployment
Track which endpoints present the replacement and watch expiry.
Verify and monitor → Test websites and APIs after replacement
Check each public and internal endpoint from real clients.
Verify and monitor → Monitor service availability
Watch TLS failures and service health after rollout.
Sources and further reading
Alert updated: 2026/10/25. Check vendor guidance for the latest support and patch status.