Over the last few days, GoDaddy has been busy revoking over 400,000 SSL certificates. What does that mean to you? It means that nearly half a million web admins woke up this morning to discover nobody could access their websites.
GoDaddy claims that they re-issued certificates and made those available to the affected sites. What they really did was told us on October 14 that we had until October 23 to fix the problem ourselves by re-keying our certificates, even though the Rulers of the Internet had told them they needed to revoke them by October 18. On October 18 they told us we only had until October 21.
They sent us an email that could be interpreted to mean “here are the replacement certificates” but which also included instructions for how to fix them yourself. That worked for a couple minor certificates we had.
The problem was our main laridian.com / www.laridian.com certificate. It is an “extended verification” certificate, which means that GoDaddy not only verifies that the site is secure, but that Laridian is the owner of the site, and that we really exist. This verification process takes about a month, so sometime around this time of year it begins.
So we didn’t have an updated certificate, nor a current one that could be re-keyed. We won’t get that until closer to January 7. But we got revoked anyway.
I woke up at 4AM this morning, thinking I’d use the early morning to work on a personal project before getting into my day. A quick check of email revealed that our certificate had been revoked. I spent from 4AM to about 2PM doing nothing but trying to get us back online. The website was up around 9:30, but we still don’t have email as of 2:30.
On a positive note, not having email meant that I could work the problem without having to deal with email from frustrated customers who couldn’t get to the website. It’s not looking promising for having email fixed any time soon (that’s a whole different story).
Anyway, that’s why we haven’t been reachable today.