# GoDaddy: Go Daddy and Starfield roots, ACME and new 2025 roots > GoDaddy's certificate authority: Go Daddy and Starfield G2 roots, the new 2025 TLS roots, ACME for paid certificates, and what Chrome has removed. Source: https://ssl.sh/cas/godaddy/ Last updated: 2026-11-10 GoDaddy, best known as a domain registrar and web host, also operates a certificate authority. It sells DV, OV and EV certificates under the GoDaddy and Starfield names, chaining to its own Go Daddy and Starfield roots, and supports ACME for the certificates it sells, but offers no free certificates. ## Owner and headquarters The CA is part of GoDaddy, a US company; its root certificates list Scottsdale, Arizona, in the subject. Starfield Technologies is a GoDaddy brand that has its own parallel set of roots. The CCADB records the CA owner as "GoDaddy". ## Root certificates As of November 2026, CCADB lists six roots under GoDaddy. Go Daddy Root Certificate Authority - G2 and Starfield Root Certificate Authority - G2 (RSA 2048, 2009–2037) are trusted for TLS by Chrome, Mozilla, Apple and Microsoft. The 2004 Class 2 roots of both brands have been removed from Chrome's store but remain in the others. In August 2025 GoDaddy created two new RSA 4096 roots, GoDaddy TLS Root CA - R1 and Starfield TLS Root CA - R1, valid until 2040; so far only Microsoft includes them. A related root, Starfield Services Root Certificate Authority - G2, is listed under [Amazon Trust Services](https://ssl.sh/cas/amazon/) in the CCADB. ## Certificate products DV, [OV](https://ssl.sh/glossary/ov-certificate/) and [EV](https://ssl.sh/glossary/ev-certificate/) TLS certificates with wildcard and multi-domain (UCC) options, sold on their own and bundled with GoDaddy hosting plans. ## ACME support GoDaddy's help center describes ACME automation for its SSL certificates: under the certificate's management page you open ACME setup and copy External Account Binding (EAB) credentials that are unique to that certificate, then use them in certbot or another client. The help page says the feature isn't available to API reseller customers, and automatic installation isn't supported on every server. ## Free certificates GoDaddy doesn't issue free certificates. Let's Encrypt's documentation notes that GoDaddy's hosting doesn't support ACME for Let's Encrypt and instead sells automated renewal of its own certificates. ## Notable incidents and changes The visible changes are on the root side: Chrome has removed the Class 2 roots from 2004, and the new R1 roots created in 2025 are still waiting for inclusion in most stores. Until they are included, GoDaddy certificates continue to chain to the G2 roots. With certificate lifetimes falling to 200 days in 2026 and 47 days in 2029 under [SC-081v3](https://ssl.sh/ballots/sc-081/), manual renewal of GoDaddy certificates becomes impractical without ACME. ## Root certificates (CCADB) GoDaddy has 6 root certificate(s) in the CCADB TLS report. Together they have signed 28 intermediate CA certificates, 22 of them still valid. | Root certificate | Key | Expires | Chrome | Mozilla | Apple | Microsoft | Intermediates | SHA-256 | |---|---|---|---|---|---|---|---|---| | Go Daddy Class 2 Certification Authority | RSA 2048 | 2034-06-29 | Removed | Included | Included | Included | 3 | C3846BF24B9E93CA64274C0EC67C1ECC5E024FFCACD2D74019350E81FE546AE4 | | Go Daddy Root Certificate Authority - G2 | RSA 2048 | 2037-12-31 | Included | Included | Included | Included | 5 | 45140B3247EB9CC8C5B4F0D7B53091F73292089E6E5A63E2749DD3ACA9198EDA | | GoDaddy TLS Root CA - R1 | RSA 4096 | 2040-08-24 | Not included | Not included | Not included | Included | 3 | 25CF3DA8E9B97ADDBF92543C2B82527C8A4E2CFF2062A6483040D4B64ACE719F | | Starfield Class 2 Certification Authority | RSA 2048 | 2034-06-29 | Removed | Included | Included | Included | 5 | 1465FA205397B876FAA6F0A9958E5590E40FCC7FAA4FB7C2C8677521FB5FB658 | | Starfield Root Certificate Authority - G2 | RSA 2048 | 2037-12-31 | Included | Included | Included | Included | 9 | 2CE1CB0BF9D2F9E102993FBE215152C3B2DD0CABDE1C68E5319B839154DBB7F5 | | Starfield TLS Root CA - R1 | RSA 4096 | 2040-08-23 | Not included | Not included | Not included | Included | 3 | 97366DA00BAF6730A84D1A8CBA5BAD7961C46BCE707E09241CC9C4C7E3C64F10 | ## CAA records The CCADB lists 2 CAA issuer domain(s) recognized by the currently valid intermediate certificates of GoDaddy. One issue record with any of them lets GoDaddy issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them. ``` example.com. CAA 0 issue "godaddy.com" example.com. CAA 0 issue "starfieldtech.com" ``` ## Audits Audit data the CCADB records for the TLS roots of GoDaddy. Auditor(s): Schellman & Company, LLC.. The most recent audit period ended on 2026-06-30. - Standard audit: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3cc4fe3a-8cb3-414d-af28-31a57a733cca) - Network security: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1cdbdd7f-2310-46ab-a56f-9ac9ea46296c) - TLS Baseline Requirements: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cd37b671-938e-4c9e-be33-233b297aa603) - TLS EV Guidelines: WebTrust 2025-07-01 – 2026-06-30 (https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=38c10e0f-7b33-46bc-aea2-9767e9953a4b) ## CP/CPS documents Certificate Policy and Certification Practice Statement links that GoDaddy has disclosed in the CCADB for its TLS roots, with effective dates: - Markdown CP/CPS: https://github.com/godaddy/cp-cps/blob/main/cpcps/TLS_CPCPS.md ## Report a certificate problem To report a mis-issued certificate, a compromised private key or other abuse, use the channels GoDaddy lists in the CCADB (replace [at] and [dot] in addresses): - practices[at]starfieldtech[dot]com - https://certs.godaddy.com/repository - https://certs.starfieldtech.com/repository ## Incident reports CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “GoDaddy”: https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=CA+Program&component=CA+Certificate+Compliance&short_desc_type=allwords&short_desc=GoDaddy&order=changeddate+DESC ## FAQ **What CAA record allows GoDaddy to issue certificates?** Publish example.com. CAA 0 issue "godaddy.com". The CCADB lists 2 recognized domain(s) for GoDaddy: godaddy.com, starfieldtech.com. **Who audits GoDaddy?** Schellman & Company, LLC., according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2025-07-01 to 2026-06-30; the statement is dated 2026-07-27. **How do I report a problem certificate to GoDaddy?** Use the channel(s) listed in the CCADB: practices[at]starfieldtech[dot]com, https://certs.godaddy.com/repository, https://certs.starfieldtech.com/repository. **How many root certificates does GoDaddy have?** 6 in the CCADB TLS report. Trusted for TLS: Chrome 2, Mozilla 2, Apple 4, Microsoft 6. They have signed 28 intermediates, 22 of them still valid. Sources: CCADB All Certificate Information (V5), List of CAA Identifiers, List of CA problem reporting mechanisms and TLS Server Authentication report (ccadb.org/resources).