Certificate authority
GoDaddy: Go Daddy and Starfield roots, ACME and new 2025 roots
Details
- CCADB CA owner
- GoDaddy
- Country
- US
- Country (CCADB)
- United States of America
- ACME
- Yes
- Free certificates
- No
- Products
- DV OV EV wildcard multi-domain
- Roots
- 6
- Roots trusted for TLS
- Chrome 2 · Mozilla 2 · Apple 4 · Microsoft 6
- Intermediates under its roots
- 28 (22 valid)
- Auditor
- Schellman & Company, LLC.
- CAA
godaddy.com
GoDaddy, best known as a domain registrar and web host, also operates a certificate authority. It sells DV, OV and EV certificates under the GoDaddy and Starfield names, chaining to its own Go Daddy and Starfield roots, and supports ACME for the certificates it sells, but offers no free certificates.
Owner and headquarters
The CA is part of GoDaddy, a US company; its root certificates list Scottsdale, Arizona, in the subject. Starfield Technologies is a GoDaddy brand that has its own parallel set of roots. The CCADB records the CA owner as "GoDaddy".
Root certificates
As of November 2026, CCADB lists six roots under GoDaddy. Go Daddy Root Certificate Authority - G2 and Starfield Root Certificate Authority - G2 (RSA 2048, 2009–2037) are trusted for TLS by Chrome, Mozilla, Apple and Microsoft. The 2004 Class 2 roots of both brands have been removed from Chrome's store but remain in the others. In August 2025 GoDaddy created two new RSA 4096 roots, GoDaddy TLS Root CA - R1 and Starfield TLS Root CA - R1, valid until 2040; so far only Microsoft includes them. A related root, Starfield Services Root Certificate Authority - G2, is listed under Amazon Trust Services in the CCADB.
Certificate products
DV, OV and EV TLS certificates with wildcard and multi-domain (UCC) options, sold on their own and bundled with GoDaddy hosting plans.
ACME support
GoDaddy's help center describes ACME automation for its SSL certificates: under the certificate's management page you open ACME setup and copy External Account Binding (EAB) credentials that are unique to that certificate, then use them in certbot or another client. The help page says the feature isn't available to API reseller customers, and automatic installation isn't supported on every server.
Free certificates
GoDaddy doesn't issue free certificates. Let's Encrypt's documentation notes that GoDaddy's hosting doesn't support ACME for Let's Encrypt and instead sells automated renewal of its own certificates.
Notable incidents and changes
The visible changes are on the root side: Chrome has removed the Class 2 roots from 2004, and the new R1 roots created in 2025 are still waiting for inclusion in most stores. Until they are included, GoDaddy certificates continue to chain to the G2 roots. With certificate lifetimes falling to 200 days in 2026 and 47 days in 2029 under SC-081v3, manual renewal of GoDaddy certificates becomes impractical without ACME.
CAA records
The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of GoDaddy. One issue record with any of them lets GoDaddy issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 2 domain(s):
example.com. CAA 0 issue "godaddy.com"
example.com. CAA 0 issue "starfieldtech.com"| Domain | Valid intermediates |
|---|---|
godaddy.com | 17 |
starfieldtech.com | 17 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
GoDaddy has 6 root certificate(s) in the CCADB TLS report. Together they have signed 28 intermediate CA certificates, 22 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| Go Daddy Class 2 Certification Authority | RSA 2048 | 2034-06-29 | Removed | Included | Included | Included | 3 (2) |
| Go Daddy Root Certificate Authority - G2 | RSA 2048 | 2037-12-31 | Included | Included | Included | Included | 5 (4) |
| GoDaddy TLS Root CA - R1 | RSA 4096 | 2040-08-24 | Not included | Not included | Not included | Included | 3 (3) |
| Starfield Class 2 Certification Authority | RSA 2048 | 2034-06-29 | Removed | Included | Included | Included | 5 (4) |
| Starfield Root Certificate Authority - G2 | RSA 2048 | 2037-12-31 | Included | Included | Included | Included | 9 (6) |
| Starfield TLS Root CA - R1 | RSA 4096 | 2040-08-23 | Not included | Not included | Not included | Included | 3 (3) |
Audits
Audit data the CCADB records for the TLS roots of GoDaddy. Auditor(s): Schellman & Company, LLC.. The most recent audit period ended on 2026-06-30.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2025-07-01 – 2026-06-30 | 2026-07-27 | cpacanada.ca |
| Network security | WebTrust | 2025-07-01 – 2026-06-30 | 2026-07-27 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2025-07-01 – 2026-06-30 | 2026-07-27 | cpacanada.ca |
| TLS EV Guidelines | WebTrust | 2025-07-01 – 2026-06-30 | 2026-07-27 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that GoDaddy has disclosed in the CCADB for its TLS roots, with effective dates:
- Markdown CP/CPS: https://github.com/godaddy/cp-cps/blob/main/cpcps/TLS_CPCPS.md (effective 2026-10-14)
- Document repository: https://certs.godaddy.com/repository
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels GoDaddy lists in the CCADB (replace [at] and [dot] in addresses):
practices[at]starfieldtech[dot]com- https://certs.godaddy.com/repository
- https://certs.starfieldtech.com/repository
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “GoDaddy”:
ACME directories (CCADB)
DV ACME directory URLs that GoDaddy has disclosed in the CCADB for its valid certificates:
https://acme.godaddy.com/v1/acme/directoryhttps://api.certainly.com/directoryhttps://acme.starfieldtech.com/v1/acme/directory
FAQ
What CAA record allows GoDaddy to issue certificates?
Publish example.com. CAA 0 issue "godaddy.com". The CCADB lists 2 recognized domain(s) for GoDaddy: godaddy.com, starfieldtech.com.
Who audits GoDaddy?
Schellman & Company, LLC., according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-07-01 to 2026-06-30; the statement is dated 2026-07-27.
How do I report a problem certificate to GoDaddy?
Use the channel(s) listed in the CCADB: practices[at]starfieldtech[dot]com, https://certs.godaddy.com/repository, https://certs.starfieldtech.com/repository.
How many root certificates does GoDaddy have?
6 in the CCADB TLS report. Trusted for TLS: Chrome 2, Mozilla 2, Apple 4, Microsoft 6. They have signed 28 intermediates, 22 of them still valid.