# Go Daddy Class 2 Certification Authority root certificate (GoDaddy)

> Go Daddy Class 2 Certification Authority is a root CA certificate operated by GoDaddy (RSA 2048, valid until 2034-06-29, SHA-256 C3846BF2). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/godaddy-go-daddy-class-2-ca/
Last updated: 2026-11-10

Go Daddy Class 2 Certification Authority is a root CA certificate operated by GoDaddy (RSA 2048, valid until 2034-06-29, SHA-256 C3846BF2). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | GoDaddy |
| Subject | OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US |
| SHA-256 | C3846BF24B9E93CA64274C0EC67C1ECC5E024FFCACD2D74019350E81FE546AE4 |
| SPKI SHA-256 | 5632D97BFA775BF3C99DDEA52FC2553410864016729C52DD6524C8A9C3B4489F |
| Valid from | 2004-06-29 |
| Expires | 2034-06-29 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 0 |
| SHA-1 (Windows thumbprint) | 2796BAE63F1801E277261BA0D77770028F20EEE4 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: All Trust Bits Turned Off; EV policy OIDs: not EV-enabled; First included in: NSS 3.10 / Firefox 1; Inclusion bug: #284677 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email; Not-before cutoff: 2026-05-19 (Code Signing, Secure Email) |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114413.1.7.23.3, 2.16.840.1.114414.1.7.23.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 3 intermediate CA certificates signed directly by Go Daddy Class 2 Certification Authority: 2 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Go Daddy Root Certificate Authority - G2 | GoDaddy | 2031-05-30 | Valid | 3A2FBE92891E57FE05D57087F48E730F17E5A5F53EF403D618E5B74D7A7E6ECB |
| Go Daddy Root Certificate Authority - G2 | GoDaddy | 2031-05-03 | Valid | 9BF58967545996194512DB6177151AFE99706AEA3DA36FEEE7AD9F8B3C0507CB |
| Go Daddy Secure Certification Authority | GoDaddy | 2026-11-16 | Revoked | 09ED6E991FC3273D8FEA317D339C02041861973549CFA6E1558F411F11211AA3 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Go Daddy Class 2 Certification Authority with a different issuer, so a client has to carry Go Daddy Class 2 Certification Authority itself in its root store to trust it.


## What happens when it expires

Go Daddy Class 2 Certification Authority is valid until 2034-06-29, about 7.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Go Daddy Class 2 Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does Go Daddy Class 2 Certification Authority expire?**

On 2034-06-29, about 7.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Go Daddy Class 2 Certification Authority issued?**

The CCADB lists 3: 2 valid, 0 expired and 1 revoked. The newest valid one is Go Daddy Root Certificate Authority - G2, valid until 2031-05-30.

**Is Go Daddy Class 2 Certification Authority cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).