Heyhey, we have a question regarding our GoodDataCloud hosting. We are getting warnings on securityscorecard.com about the certificate that is being used for gooddata. Specifically, the problem seems to be, that the used certificate doesn’t have revocation controls. Is this something, you can change?

I'm sorry, but the knowledge sources do not contain specific information about whether GoodData Cloud's SSL/TLS certificates include revocation controls (such as CRL or OCSP support), or whether this is something that can be changed or configured by customers. The documentation does confirm that GoodData Cloud uses certificates issued by Let's Encrypt for its default domains, and that you can provide your own SSL certificate if you use a custom domain. However, it does not detail the revocation mechanisms in use for these certificates or provide options to configure revocation controls directly. If you require a custom certificate, you can provide your own in PEM format, but again, the revocation settings are not discussed in the available documentation [Change Domain Name](https://www.gooddata.com/docs/cloud/manage-organization/change-domain-name/). For a definitive answer or to request changes regarding certificate revocation controls, you should contact GoodData Support directly.

We as a customer are not in control of the certificate, so this can only be handled by gooddata

I think this is a false-positive. By default the certificates are issued by LetsEncrypt and all should look like this one and contain CRL Distribution Points ( 2.5.29.31 ) extension.

thanks for that info. I agree that this looks like a false positive, and I reported it like this to security-scorecard.