GoDaddy recently discovered that almost 9,000 SSL certificates that it has issued since July 29, 2016, had to be revoked and reissued. A code bug that occurred during a service upgrade caused this SSL certificate security problem.

In July, GoDaddy changed its validation code. This change unintentionally allowed certain servers that were configured in a particular way to bypass GoDaddy’s authentication process, which is necessary to deliver an SSL certificate.

SSL Certificate Security Incident Reported

Wayne Thayer, GoDaddy’s general manager of security products, declared in an incident report that the company had fixed the problem.

“We are currently unaware of any malicious exploitation of this bug to procure a certificate for a domain that was not authorized,” he wrote. “The customer who discovered the bug revoked the certificate they obtained and subsequent certificates issued as the result of requests used for testing by Microsoft and GoDaddy have been revoked. Further, any certificate requests made for domains we flag as high-risk were also subjected to manual review, rather than being issued purely based on an invalid domain authorization.”

SecurityWeek noted that GoDaddy has identified 8,951 certificates that were issued without the proper domain validation. That would be about 2 percent of the total number of certificates issued between July 29, 2016, and Jan. 10, 2017. GoDaddy reported that the incident affected approximately 6,100 customers.

CA Inconsistency

Discussion on the Google board after Thayer’s incident report was published revolved around possible underlying operational inconsistency among certificate authorities (CA).

“As you will know, the method being used by GoDaddy here corresponds broadly to method 3.2.2.4.6 from ballot 169 — “Agreed-Upon Change to Website,” one user wrote. “Although this method is not currently in the BaselineRequirements due to it being part of ballot 182 and having a related IPR disclosure, at least one root store operator has suggested they are going to require strict adherence to the methods listed in that ballot by March 1.”

In other words, the exact implementation of a baseline requirement by a CA may vary from one CA to another. This points to a need for standardized approaches.