# Starfield Services Root Certificate Authority - G2 root certificate (Amazon Trust Services)

> Starfield Services Root Certificate Authority - G2 is a root CA certificate operated by Amazon Trust Services (RSA 2048, valid until 2037-12-31, SHA-256 568D6905). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/amazon-starfield-services-root-ca-g2/
Last updated: 2026-11-10

Starfield Services Root Certificate Authority - G2 is a root CA certificate operated by Amazon Trust Services (RSA 2048, valid until 2037-12-31, SHA-256 568D6905). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | Amazon Trust Services |
| Subject | CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US |
| SHA-256 | 568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5 |
| SPKI SHA-256 | 2B071C59A0A0AE76B0EADB2BAD23BAD4580B69C3601B630C2EAF0613AFA83F92 |
| Valid from | 2009-09-01 |
| Expires | 2037-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 0 |
| SHA-1 (Windows thumbprint) | 925A8F8D2C6D04E0665F596AFF22D863E8256F3F |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.12.10 / Firefox 6.0; Inclusion bug: #1172401 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping; Not-before cutoff: 2021-08-01 (Code Signing) |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114414.1.7.24.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 10 intermediate CA certificates signed directly by Starfield Services Root Certificate Authority - G2: 8 currently valid, 0 expired and 2 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Amazon SFG2 N2 ECDSA 256 Root M1 | Amazon Trust Services | 2037-12-30 | Valid | 45233748A32B41500A6D1FB96835ACAF94EB6D55C6D686050433C342FC7D9C2D |
| Amazon SFG2 N2 RSA 2048 Root M1 | Amazon Trust Services | 2037-12-30 | Valid | 400B15204F9DFE1662AD470206B198023C16AE8E38F0CA8ACA2918557C8F9F1E |
| Amazon SFG2 N2 ECDSA 384 Root M1 | Amazon Trust Services | 2037-12-30 | Valid | 0DDF91016D79B4A9E28654C55696A4216017ECDD2C3099C144985BDC0F79F2DD |
| Amazon Root CA 1 | Amazon Trust Services | 2037-12-31 | Valid | 391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861 |
| Amazon Root CA 2 | Amazon Trust Services | 2037-12-31 | Valid | 8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0 |
| Amazon Root CA 1 | Amazon Trust Services | 2037-12-31 | Valid | 87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706 |
| Amazon Root CA 4 | Amazon Trust Services | 2037-12-31 | Valid | 543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6 |
| Amazon Root CA 3 | Amazon Trust Services | 2037-12-31 | Valid | 40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E |
| Amazon | Amazon | 2025-10-19 | Revoked | DFCC775C644DB4A33AD71293433F463C8E31057CE22CB267F9D31A0353F4FC2F |
| Amazon | Amazon Trust Services | 2040-10-21 | Revoked | E39D3ED886E5A3AF26B9D6AB608028BC6FBC52E599CB323DA7E9E775B530337C |

## Cross-signed versions

2 certificate(s) in the CCADB have the same subject and public key as Starfield Services Root Certificate Authority - G2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Starfield Services Root Certificate Authority - G2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield Class 2 Certification Authority | GoDaddy | 2034-06-28 | Valid | 2D12B619A660CEFB013271831D891213FC434E982A21568256CF4E2E86324BEA |
| Starfield Class 2 Certification Authority | GoDaddy | 2034-06-28 | Valid | 28689B30E4C306AAB53B027B29E36AD6DD1DCF4B953994482CA84BDC1ECAC996 |

## What happens when it expires

Starfield Services Root Certificate Authority - G2 is valid until 2037-12-31, about 11.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Starfield Services Root Certificate Authority - G2 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla, Apple, Microsoft trust it for TLS server authentication; Chrome do not.

**When does Starfield Services Root Certificate Authority - G2 expire?**

On 2037-12-31, about 11.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Starfield Services Root Certificate Authority - G2 issued?**

The CCADB lists 10: 8 valid, 0 expired and 2 revoked. The newest valid one is Amazon SFG2 N2 ECDSA 256 Root M1, valid until 2037-12-30.

**Is Starfield Services Root Certificate Authority - G2 cross-signed?**

Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Starfield Class 2 Certification Authority; 2 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).