# Starfield Class 2 Certification Authority root certificate (GoDaddy)

> Starfield Class 2 Certification Authority is a root CA certificate operated by GoDaddy (RSA 2048, valid until 2034-06-29, SHA-256 1465FA20). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/godaddy-starfield-class-2-ca/
Last updated: 2026-11-10

Starfield Class 2 Certification Authority is a root CA certificate operated by GoDaddy (RSA 2048, valid until 2034-06-29, SHA-256 1465FA20). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | GoDaddy |
| Subject | OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US |
| SHA-256 | 1465FA205397B876FAA6F0A9958E5590E40FCC7FAA4FB7C2C8677521FB5FB658 |
| SPKI SHA-256 | 15F14AC45C9C7DA233D3479164E8137FE35EE0F38AE858183F08410EA82AC4B4 |
| Valid from | 2004-06-29 |
| Expires | 2034-06-29 |
| Key | RSA 2048 |
| Signature algorithm | sha1WithRSAEncryption |
| Serial number | 0 |
| SHA-1 (Windows thumbprint) | AD7E1C28B064EF8F6003402014C3D0E3370EB58A |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Removed | No | - | - |
| Mozilla | Included | No | - | Trust bits: All Trust Bits Turned Off; EV policy OIDs: not EV-enabled; First included in: NSS 3.10 / Firefox 1; Inclusion bug: #284677 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email; Not-before cutoff: 2026-05-19 (Code Signing, Secure Email) |

The CCADB lists EV policy OID 2.23.140.1.1, 2.16.840.1.114414.1.7.23.3, 2.16.840.1.114413.1.7.23.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 5 intermediate CA certificates signed directly by Starfield Class 2 Certification Authority: 4 currently valid, 0 expired and 1 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield Root Certificate Authority - G2 | GoDaddy | 2031-05-30 | Valid | 9F43D52E808C20AFF69E02FAAC205AAC684E6975213D6620FAC64BDE5FCAB4BC |
| Starfield Root Certificate Authority - G2 | GoDaddy | 2031-05-03 | Valid | 454040E4969070401CC35BDF7F2A4EBCE5797BB7694AE731D93A8115FD59929C |
| Starfield Services Root Certificate Authority - G2 | Amazon Trust Services | 2034-06-28 | Valid | 28689B30E4C306AAB53B027B29E36AD6DD1DCF4B953994482CA84BDC1ECAC996 |
| Starfield Services Root Certificate Authority - G2 | Amazon Trust Services | 2034-06-28 | Valid | 2D12B619A660CEFB013271831D891213FC434E982A21568256CF4E2E86324BEA |
| Starfield Secure Certification Authority | GoDaddy | 2026-11-16 | Revoked | 05A6DB389391DF92E0BE93FDFA4DB1E3CF53903918B8D9D85A9C396CB55DF030 |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as Starfield Class 2 Certification Authority with a different issuer, so a client has to carry Starfield Class 2 Certification Authority itself in its root store to trust it.


## What happens when it expires

Starfield Class 2 Certification Authority is valid until 2034-06-29, about 7.6 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Starfield Class 2 Certification Authority trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does Starfield Class 2 Certification Authority expire?**

On 2034-06-29, about 7.6 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Starfield Class 2 Certification Authority issued?**

The CCADB lists 5: 4 valid, 0 expired and 1 revoked. The newest valid one is Starfield Root Certificate Authority - G2, valid until 2031-05-30.

**Is Starfield Class 2 Certification Authority cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).