# Starfield TLS Root CA - R1 root certificate (GoDaddy)

> Starfield TLS Root CA - R1 is a root CA certificate operated by GoDaddy (RSA 4096, valid until 2040-08-23, SHA-256 97366DA0). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

Source: https://ssl.sh/roots/godaddy-starfield-tls-root-ca-r1/
Last updated: 2026-11-10

Starfield TLS Root CA - R1 is a root CA certificate operated by GoDaddy (RSA 4096, valid until 2040-08-23, SHA-256 97366DA0). As of the latest CCADB data it is trusted for TLS server authentication by 1 of 4 major root stores: Microsoft.

| Field | Value |
|---|---|
| CA owner | GoDaddy |
| Subject | CN=Starfield TLS Root CA - R1,O=Starfield Technologies,C=US |
| SHA-256 | 97366DA00BAF6730A84D1A8CBA5BAD7961C46BCE707E09241CC9C4C7E3C64F10 |
| SPKI SHA-256 | C30F47F39B33023201E01FC538B757932E53B2B34B8778D1C41C5C951CF8AA56 |
| Valid from | 2025-08-27 |
| Expires | 2040-08-23 |
| Key | RSA 4096 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | FCE28F249CBB8089B5B384EC8FC33A1E |
| SHA-1 (Windows thumbprint) | ED1BED9C312B7783B0E3EF9DAEE9C642ECB86937 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Not included | No | - | - |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication |

The CCADB lists no EV policy OID for Starfield TLS Root CA - R1.

## Intermediate CAs issued by this root

The CCADB lists 3 intermediate CA certificates signed directly by Starfield TLS Root CA - R1: 3 currently valid, 0 expired and 0 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield TLS Intermediate CA OV - R1v1 | GoDaddy | 2040-08-23 | Valid | D25CE348C06DFD65D8D751BB94FAF7113820FD535FE1471A282EC738F3FC3CBF |
| Starfield TLS Intermediate CA EV - R1v1 | GoDaddy | 2040-08-23 | Valid | CB5A1827D55838C04F9E8C8C152CA8711B026745A3255412A30173DCAB2A661A |
| Starfield TLS Intermediate CA DV - R1v1 | GoDaddy | 2040-08-23 | Valid | 06891C34A2E4687C630B29850CC9F6D45DED39491CF877C7246B6EC633587A2C |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Starfield TLS Root CA - R1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Starfield TLS Root CA - R1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Starfield Root Certificate Authority - G2 | GoDaddy | 2037-12-31 | Valid | 26A93D60039077654C0DDA1FB634AF5FF5C114C7AC1FD0449B1C9D2178B028FF |

## What happens when it expires

Starfield TLS Root CA - R1 is valid until 2040-08-23, about 13.8 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Starfield TLS Root CA - R1 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Microsoft trust it for TLS server authentication; Chrome, Mozilla, Apple do not.

**When does Starfield TLS Root CA - R1 expire?**

On 2040-08-23, about 13.8 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Starfield TLS Root CA - R1 issued?**

The CCADB lists 3: 3 valid, 0 expired and 0 revoked. The newest valid one is Starfield TLS Intermediate CA OV - R1v1, valid until 2040-08-23.

**Is Starfield TLS Root CA - R1 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Starfield Root Certificate Authority - G2; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).