Request to disable SMIME trust bit for GoDaddy and Starfield G2 roots
GoDaddy requested that Mozilla disable the SMIME “trust bit” (email and code signing trust bits) for specific GoDaddy and Starfield G2 root certificates that are active in Mozilla’s root store. In the request, GoDaddy stated that although the roots can technically support code signing and SMIME certificates, GoDaddy only uses them in trust chains for DV, OV, and EV leaf certificates, and that it no longer issues code signing certificates (last issuance in early 2021; last certificate under management expired in late 2022). GoDaddy also stated it has not used these roots for SMIME issuance and does not plan to do so. Mozilla confirmed that the Go Daddy Root Certificate Authority - G2 and the Starfield Root Certificate Authority - G2 are not enabled for email issuance in NSS, and that none of the four certificates are trusted in NSS for code signing, leaving two root certificates affected by the request. Mozilla distributed the resulting change in Nightly 139.0a1 on 2025-04-28, and the bug is marked RESOLVED with resolution FIXED. The bug was created by GoDaddy (Steven Deitte) and assigned to Ben Wilson (b**********n@mozilla.com).
- GoDaddy requested removal of SMIME (email and code signing) trust bits for specific active GoDaddy/Starfield G2 roots in Mozilla’s root store.
- Mozilla distributed the trust-bit change in Nightly 139.0a1 (2025-04-28).
- GoDaddy — Steven Deitte requested removal of email and code signing trust bits for GoDaddy Class 2 and Starfield Class 2 G2 roots, explaining GoDaddy no longer issues code signing and does not plan SMIME issuance.
- Mozilla representative — Ben Wilson confirmed the G2 roots are not enabled for email issuance in NSS and that none are trusted for code signing, identifying the two affected root certificates.
- Mozilla representative — bbeurdouche created an attachment for disabling the SMIME trust bit for the GoDaddy CAs.
- Mozilla representative — bbeurdouche linked an NSS revision (hg-edge.mozilla.org) related to the change.
- Mozilla representative — Ben Wilson confirmed the change was distributed in Nightly 139.0a1 (2025-04-28).