2026-10-22: SSL Certificate Authority Change#
Incident Summary#
Date: October 22, 2026
Incident window: Approximately 12:00 AM–2:00 AM Pacific Daylight Time (PDT)
This morning, Melissa identified an issue involving the revocation of our TLS Certificate. This certificate was a Starfield Class 2 certificate that was set to expire on December 15, 2026. However, it was incorrectly revoked before expiration due to a bug on GoDaddy’s side.
To minimize potential customer impact, we accelerated the migration and deployed our replacement GlobalSign TLS certificate rather than wait for GoDaddy to investigate and resolve the revocation issue.
Impact#
We do not expect widespread impact for customers using modern TLS configurations and trust stores. The Starfield certificate had not expired and the new GlobalSign certificate is also valid. There was also no change to the cipher suite.
There could be impact on systems that checked the revocation list before the GlobalSign certificate was installed, which was approximately 2:00 AM PDT.
Additionally, there could be impact on systems that require TLS Certificates to be installed locally in order to use our services. Since this was a change in certificate authority, those users could have been blocked from using our service until the new TLS certificate was installed.
Root Cause#
According to GoDaddy’s preliminary incident report, discrepancies between documented certificate profiles and the certificates actually issued resulted in noncompliance with certificate policy requirements, including X.509 Certificate Policy identifiers (OIDs) and Certification Practice Statement (CPS) information. This led to the mass revocation of affected certificates, including our Starfield TLS certificate. GoDaddy’s investigation into the underlying cause and preventative measures is ongoing.
Resolution#
Our resolution was to switch to our planned certificate authority (GlobalSign) ahead of schedule. This removed the impact of having the Starfield certificate on the revocation list.
Corrective and Preventative Actions#
When more information is known, we will review possible preventive action. However, this appears to be a GoDaddy issue that was not foreseeable or preventable by Melissa.
Closing Statement#
Our TLS certificate management strategy is evolving with the overall industry-wide changes. The CA/Browser Forum has established a phased reduction in the maximum validity period for publicly trusted TLS server certificates: 200 days beginning March 15, 2026; 100 days beginning March 15, 2027; and 47 days beginning March 15, 2029. These requirements apply to newly issued certificates and will make automated certificate issuance, renewal, and deployment increasingly important.
We encourage our users to review their environments to ensure they are ready for the upcoming changes and be ready for faster, automated TLS certificate renewals.
Thank you,
Melissa Data Web Service Team