# Starfield Root Certificate Authority - G2 root certificate (GoDaddy)

> Starfield Root Certificate Authority - G2 is a root CA certificate operated by GoDaddy (RSA 2048, valid until 2037-12-31, SHA-256 2CE1CB0B). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/godaddy-starfield-root-ca-g2/
Last updated: 2026-11-10

Starfield Root Certificate Authority - G2 is a root CA certificate operated by GoDaddy (RSA 2048, valid until 2037-12-31, SHA-256 2CE1CB0B). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | GoDaddy |
| Subject | CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US |
| SHA-256 | 2CE1CB0BF9D2F9E102993FBE215152C3B2DD0CABDE1C68E5319B839154DBB7F5 |
| SPKI SHA-256 | 808D68B3FAB4884A5F971ACE7D10550D7A95A163774F3EC36AFFFB213FBE4C74 |
| Valid from | 2009-09-01 |
| Expires | 2037-12-31 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 0 |
| SHA-1 (Windows thumbprint) | B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.16.840.1.114414.1.7.23.3; First included in: NSS 3.12.10 / Firefox 6.0; Inclusion bug: #527056 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth; Allowed policies: Server Authentication, Client Authentication, Code Signing, Timestamp Signing |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Encrypting File System, IP Security Tunnel Termination, IP Security User, Secure Email, Time Stamping; Not-before cutoff: 2026-05-19 (Code Signing, Secure Email) |

Mozilla treats it as an EV root for policy OID 2.16.840.1.114414.1.7.23.3.

## Intermediate CAs issued by this root

The CCADB lists 9 intermediate CA certificates signed directly by Starfield Root Certificate Authority - G2: 6 currently valid, 0 expired and 3 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield TLS Root CA - R1 | GoDaddy | 2037-12-31 | Valid | 26A93D60039077654C0DDA1FB634AF5FF5C114C7AC1FD0449B1C9D2178B028FF |
| Certainly Intermediate R1 | Certainly LLC | 2032-06-21 | Valid | FEC41E32CA75C295A6240FA639D3ABE3BFB5CB131D6690E2331A176BED2E5BD2 |
| Certainly Intermediate E1 | Certainly LLC | 2032-06-21 | Valid | 3379233C434610C8EAA9361ACBDD24C7D655409C6D680A8C2585FFDA27011EE7 |
| Starfield Secure Extended Validation Code Signing CA - G2 | GoDaddy | 2035-05-01 | Valid | F41A694B3825942DB89523E9775F997DB9FA2998398DC39A74B72670DACFD468 |
| Starfield Secure Code Signing Certificate Authority - G2 | GoDaddy | 2034-04-01 | Valid | 26CFA206753E96AED7C30F5674E7C6F5A0CB2F93837AF6A1596C2F799C725385 |
| Starfield Secure Certificate Authority - G2 | GoDaddy | 2031-05-03 | Valid | 93A07898D89B2CCA166BA6F1F8A14138CE43828E491B831926BC8247D391CC72 |
| Starfield Secure Certificate Authority - G5 | GoDaddy | 2042-06-21 | Revoked | 29E502995310403685DD6258F9D04856878963042D4749C6D5D9773A310C31C0 |
| Certainly Intermediate R1 | Certainly LLC | 2032-06-21 | Revoked | 1D233EDB537734EDDC55D9BDDD81A9AA4468B33040654D0342CD676C6B70EF33 |
| Certainly Intermediate E1 | Certainly LLC | 2032-06-21 | Revoked | 0B18D4C20C67A99E72DFBFCA5A2E256B8BBC9E082B0270378CC1A1F0CC461AB4 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Starfield Root Certificate Authority - G2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Starfield Root Certificate Authority - G2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield Class 2 Certification Authority | GoDaddy | 2031-05-30 | Valid | 9F43D52E808C20AFF69E02FAAC205AAC684E6975213D6620FAC64BDE5FCAB4BC |

## What happens when it expires

Starfield Root Certificate Authority - G2 is valid until 2037-12-31, about 11.1 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Starfield Root Certificate Authority - G2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Starfield Root Certificate Authority - G2 expire?**

On 2037-12-31, about 11.1 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Starfield Root Certificate Authority - G2 issued?**

The CCADB lists 9: 6 valid, 0 expired and 3 revoked. The newest valid one is Starfield TLS Root CA - R1, valid until 2037-12-31.

**Is Starfield Root Certificate Authority - G2 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Starfield Class 2 Certification Authority; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).