Key points
- GoDaddy revoked 404,607 incorrectly issued SSL certificates worldwide, according to HM Government of Gibraltar.
- Some Gibraltar Government websites use the revoked certificates and may show security warnings.
- The Information Technology and Logistics Department (ITLD) is installing replacement certificates.
- The Government describes the revocation as a GoDaddy error and says no security breach occurred.
- ITLD is separately applying updates after a UK National Cyber Security Centre advisory on a PHP vulnerability.
Some Gibraltar Government websites may show security warnings or fail to open after a GoDaddy certificate error, with GoDaddy revoking 404,607 SSL certificates it had issued incorrectly, HM Government of Gibraltar said in press release 818/2026 on 22 October 2026. The Information Technology and Logistics Department (ITLD) is installing replacements.
The GoDaddy certificate error
GoDaddy is a certificate authority, the body that issues the SSL certificates browsers use to confirm a site’s identity. According to GoDaddy’s help page on the bug, the incorrectly issued certificates were revoked on 21 October 2026. After revocation, visitors may see security warnings, and a site can become unavailable until a replacement certificate is installed.
Cyber Security News reported that a third party flagged certificates that did not match the profiles in the CP/CPS, the documents that set out how the authority issues them, and that GoDaddy began contacting subscribers on 14 October.
“This is an error by GoDaddy, not a security breach.”
HM Government of Gibraltar, press release 818/2026, 22 October 2026
The release does not name the affected sites or mention the Gambling Division or any licensing site for Gibraltar‘s iGaming operators.
GoDaddy tells customers to check the SSL certificates section of their account, which shows whether a domain still needs a replacement, and to install the new certificate on the server. Cyber Security News noted that a replacement sitting in an account does not mean the site is serving it.
What visitors are told
The Government advises visitors who see a warning not to click past it and not to enter personal or payment details. They should close the page and try again later. To reach a genuine Government site, visitors should type the address into the browser and avoid links in emails, texts or social media posts.
The Government said it will never ask anyone to ignore a security warning, and that people need not install or change anything on their own devices.
Separate PHP updates
ITLD is also applying updates to the Government’s externally facing systems after the UK National Cyber Security Centre (NCSC) issued an advisory on 21 October about a vulnerability in PHP, the release said. The Government said the certificate warnings are unrelated to that vulnerability.
ITLD is installing the replacement certificates now. The Government has not given a date for completing the work.
