An error by GoDaddy, one of the companies that issues website security certificates worldwide, has affected some HM Government of Gibraltar websites. GoDaddy has revoked 404,607 certificates worldwide that it issued incorrectly, and the Information Technology and Logistics Department (ITLD) has confirmed that some Government websites use them. Visitors to these sites may see a security warning in their browser, or may be unable to open the site, until a replacement certificate is in place.

SSL certificates allow a web browser to confirm that a website is genuine and to protect the information sent to and from it. GoDaddy revoked the affected certificates because they did not follow its own published certificate policies. This is an error by GoDaddy, not a security breach.

The issue affects every website that uses an affected GoDaddy certificate, not only Government websites. The warnings are caused by the revocation, not by any attack on the websites, and they are not connected to the PHP security vulnerability reported on all major news networks today. 

Separately, following the advisory issued by the UK’s National Cyber Security Centre on 21 October about a security vulnerability in PHP, ITLD immediately began applying the necessary updates to the Government’s externally facing systems.

ITLD is installing replacement certificates on the affected Government websites. 

Anyone who sees a security warning on a Government website should not click past it or enter any personal or payment details. Close the page and try again later.

To be sure of reaching a genuine Government website, type the address into the browser rather than following a link in an email, text message, or social media post. The Government will never ask anyone to ignore a security warning to use its websites.

There is nothing members of the public need to install or change on their own devices.