GoDaddy SSL Certificate Disruption: What Businesses Need to Know

Christopher Souza | CEO

GoDaddy’s recent SSL/TLS certificate issue has created a concern for businesses that extend beyond their public websites. Depending on where affected certificates are installed, organizations could experience interruptions to email, remote access, customer portals, business applications, and automated connections between systems.

GoDaddy’s October 22 update confirmed that 403,643 certificates were affected, and all had been revoked or expired. Businesses still using those certificates need to ensure replacements are installed wherever they are needed, not simply available for download in their GoDaddy accounts.

More Than Your Website Could Be Affected

SSL/TLS certificates help systems verify the identity of the server they are connecting to and establish encrypted connections. Although commonly associated with websites, these certificates also support services employees and customers rely on every day.

If an affected certificate remains in use, potential disruptions include:

• Websites and customer portals: Visitors may see security warnings or be unable to access accounts, submit requests, or complete purchases.
• VPNs and remote access: Employees may receive certificate errors or be unable to connect to the company network.
• Remote Desktop gateways: Staff may lose access to hosted desktops and business applications.
• Email systems: Organizations using affected certificates on Exchange or other mail servers may encounter errors with email clients, mobile synchronization, or secure mail connections.
• Business applications and integrations: Connections between systems may fail, interrupting transactions, data synchronization, or automated workflows.
• Other secure services: File transfer systems, authentication endpoints, and management interfaces may require attention if they use an affected certificate.

These are potential exposure points, not a claim that every service experienced an outage with the determining factor being whether a system uses one of the affected GoDaddy or Starfield certificates. A business can also be affected even when its systems are hosted by another provider.

The Business Impact Goes Beyond First Impressions

A prospective customer arriving at your website through a referral, advertisement, or search engine may leave immediately after encountering a privacy warning and existing customers may be unable to access services or complete transactions, while advertising spending continues to send visitors to an inaccessible page.

Inside the business, the consequences can be equally disruptive. Employees who cannot connect remotely or access essential applications may be unable to complete their work. Failed integrations can interrupt operations without displaying an obvious browser warning which is why checking the company homepage alone is not enough. Unfortunately, a functioning website does not confirm that email, remote access, or other certificate-dependent services are working correctly.

What Went Wrong with GoDaddy Certificates

According to GoDaddy’s incident disclosure, certain certificates issued under its GoDaddy and Starfield TLS hierarchies contained certificate policy information that did not conform to its published Certificate Policy and Certification Practice Statement.

GoDaddy suspended issuance, corrected its documentation, and began replacing and revoking the affected certificates. Revocation ends a certificate’s validity before its scheduled expiration and as a result, a business can experience certificate errors even when it has paid for its certificate and no renewal is due.

GoDaddy’s October 22 update confirmed that all affected certificates had been revoked or expired, however, completion of that process does not establish that every affected business successfully installed and activated its replacements.

Replacement Certificates Must Be Installed Wherever They Are Used

A replacement certificate in a GoDaddy account does not necessarily mean the affected service has been updated. GoDaddy’s customer notice specifically directs affected customers to download and install replacement certificates when action is required.

The same certificate may be installed on multiple servers, appliances, or services but updating one location may leave others using the revoked version. Supporting certificates also matter. Your IT provider should verify that each service presents the correct replacement certificate and the complete supporting certificate chain. In order to help clients resolve the issue, GoDaddy provided detailed guidance for resolving certificate chain and untrusted root errors, but recovery may also require coordination among your IT support team, website provider, hosting company, and application vendors.

What Your Business Should Do Now

If you have a dedicated IT team or IT provider, you’ll want to coordinate the following tasks:

• Identify affected certificates and every place they are used. Review GoDaddy account alerts and inventory certificates across websites, email servers, VPNs, remote access systems, applications, and other secure services.
• Install and activate replacements. Confirm that each affected service is actually presenting the new certificate, with the required supporting chain. Check all relevant servers and appliances, including systems sharing a certificate.
• Test real business functions. Check website forms, account access, and payment pages. Test remote connections, email access, critical applications, and automated integrations as applicable.
• Verify access from outside the office. External testing can help identify problems that an internal connection may not reveal. Browser checks should be supplemented with testing appropriate to each service.
• Assign clear responsibility. Establish who monitors certificate notices, installs urgent replacements, coordinates providers, and verifies that service has been restored.

Do not bypass certificate warnings as a workaround and make sure to report them to the provider responsible for the affected system.

Contact TSI Today!

Certificate problems can disrupt customer access and everyday business operations. A prompt, coordinated response helps reduce prolonged disruption and restore confidence in the systems your organization depends on.

If your business is experiencing certificate warnings, connection failures, or uncertainty about which systems need attention, contact TSI today. We can help assess the issue and coordinate the steps needed to keep your employees connected, your customers supported, and your business moving.

About Technical Support International

TSI is 37-year old cybersecurity (MSSP) and IT support (MSP) company specializing in helping DIB organizations address their NIST 800-171 and CMMC compliance obligations. As a CMMC-AB Registered Provider Organization (RPO), TSI offers a complete NIST 800-171 and CMMC support solution to help guide our clients toward a successful certification audit and provide the assurance that they’re adhering to these expansive compliance requirements.