GoDaddy root inclusion request with CP/CPS corrections and related incident follow-up
This case remains a Mozilla root inclusion request for the GoDaddy R1 Root CA and the Starfield R1 Root CA. GoDaddy opened the bug and provided the Mozilla Root Inclusion Case Information page plus PEM files for both roots. Mozilla reviewed the Starfield/GoDaddy CP/CPS and raised a number of clarity and consistency comments during the inclusion review process. GoDaddy said it was working through the feedback, released TLS CP/CPS version 6.0 on 2026-10-08, and later confirmed that some reported inaccuracies were real. On 2026-10-15, GoDaddy said it stopped issuance under the affected certificate profiles after confirmation, then resumed issuance after the CP/CPS was updated. GoDaddy also said it is opening an incident report to address the affected certificates and certain other issues identified during the investigation. The bug is still assigned to Ben Wilson, and the thread does not state a final approval or rejection.
- GoDaddy requested Mozilla root inclusion for the GoDaddy R1 Root CA and the Starfield R1 Root CA.
- Mozilla posted a review of the Starfield/GoDaddy CP/CPS as part of the root inclusion review process.
- The root inclusion request entered public discussion.
- Public discussion closed.
- GoDaddy released version 6.0 of its TLS CP/CPS.
- GoDaddy confirmed inaccuracies in the documented certificate profiles, stopped issuance under the affected profiles, and later resumed issuance after updating the CP/CPS.
- GoDaddy — Opened the bug and linked the Mozilla Root Inclusion Case Information in CCADB.
- GoDaddy — Attached the GoDaddy R1 Root CA PEM file.
- GoDaddy — Attached the Starfield R1 Root CA PEM file.
- Mozilla representative — Posted CP/CPS review comments and said they were for clarity and transparency, not compliance or enforcement.
- GoDaddy — Acknowledged the review and said GoDaddy CA was working through CP/CPS updates.
- Mozilla representative — Said the request entered public discussion on Aug. 17, 2026 and would conclude on Sept. 28, 2026.
- Community commenter — Asked for an update on the new CPS.
- GoDaddy — Said GoDaddy CA had made good progress on CP/CPS updates and expected to release the updated CP/CPS by October 9th.
- Mozilla representative — Said public discussion closed on 2026-09-29 and Mozilla published notice of intent to approve, starting a final call ending on 2026-10-09.
- Mozilla representative — Said approval would be deferred until at least seven days after GoDaddy submits its updated CPS for review.
- GoDaddy — Said version 6.0 of the TLS CP/CPS had been released.
- Community commenter — Listed remaining CP/CPS issues and new concerns about delegated third parties, DNSSEC/CAA references, and inconsistent practices across the document.
- GoDaddy — Confirmed inaccuracies in the documented certificate profiles, said issuance under the affected profiles was stopped and later resumed after the CP/CPS update, and said GoDaddy is opening an incident report.