January 16, 2017 By Larry Loeb 2 min read

GoDaddy recently discovered that almost 9,000 SSL certificates that it has issued since July 29, 2016, had to be revoked and reissued. A code bug that occurred during a service upgrade caused this SSL certificate security problem.

In July, GoDaddy changed its validation code. This change unintentionally allowed certain servers that were configured in a particular way to bypass GoDaddy’s authentication process, which is necessary to deliver an SSL certificate.

SSL Certificate Security Incident Reported

Wayne Thayer, GoDaddy’s general manager of security products, declared in an incident report that the company had fixed the problem.

“We are currently unaware of any malicious exploitation of this bug to procure a certificate for a domain that was not authorized,” he wrote. “The customer who discovered the bug revoked the certificate they obtained and subsequent certificates issued as the result of requests used for testing by Microsoft and GoDaddy have been revoked. Further, any certificate requests made for domains we flag as high-risk were also subjected to manual review, rather than being issued purely based on an invalid domain authorization.”

SecurityWeek noted that GoDaddy has identified 8,951 certificates that were issued without the proper domain validation. That would be about 2 percent of the total number of certificates issued between July 29, 2016, and Jan. 10, 2017. GoDaddy reported that the incident affected approximately 6,100 customers.

CA Inconsistency

Discussion on the Google board after Thayer’s incident report was published revolved around possible underlying operational inconsistency among certificate authorities (CA).

“As you will know, the method being used by GoDaddy here corresponds broadly to method 3.2.2.4.6 from ballot 169 — “Agreed-Upon Change to Website,” one user wrote. “Although this method is not currently in the BaselineRequirements due to it being part of ballot 182 and having a related IPR disclosure, at least one root store operator has suggested they are going to require strict adherence to the methods listed in that ballot by March 1.”

In other words, the exact implementation of a baseline requirement by a CA may vary from one CA to another. This points to a need for standardized approaches.

More from

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Will AI threaten the role of human creativity in cyber threat detection?

4 min read - Cybersecurity requires creativity and thinking outside the box. It’s why more organizations are looking at people with soft skills and coming from outside the tech industry to address the cyber skills gap. As the threat landscape becomes more complex and nation-state actors launch innovative cyberattacks against critical infrastructure, there is a need for cybersecurity professionals who can anticipate these attacks and develop creative preventive solutions.Of course, a lot of cybersecurity work is mundane and repetitive — monitoring logs, sniffing out…

Hacking the mind: Why psychology matters to cybersecurity

4 min read - In cybersecurity, too often, the emphasis is placed on advanced technology meant to shield digital infrastructure from external threats. Yet, an equally crucial — and underestimated — factor lies at the heart of all digital interactions: the human mind. Behind every breach is a calculated manipulation, and behind every defense, a strategic response. The psychology of cyber crime, the resilience of security professionals and the behaviors of everyday users combine to form the human element of cybersecurity. Arguably, it's the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today