1943135 - Request to disable SMIME "trust bit" for GoDaddy CAs

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Steven Deitte]

For the following roots which are active in Mozilla's root store, we would like to remove the email and code signing trust bits:
GoDaddy Class 2 Certification Authority
GoDaddy Root Certificate Authority - G2
Starfield Class 2 Certification Authority
Starfield Root Certificate Authority - G2
While these roots are technically capable of supporting code signing and SMIME certificates today, GoDaddy only uses these existing roots in trust chains that support Domain Validated (DV), Organization Validated (OV), and Extended Validation (EV) leaf certificates. A few additional notes related to the trust bit removal which may be relevant:

Related to Code Signing: We used to, but no longer issue code signing certificates. The last code signing certificate issuance was in early 2021 and the last code signing certificate under management expired in late 2022. We completed a code signing audit report last year (7/1/2022 to 6/30/2023) to address our last certificates under management, but did not complete this year since we no longer issue nor have under management any code signing certificates.
Related to SMIME: We have not in the past nor do we plan to use these roots to support SMIME certificate issuance

Comment 1

[Ben Wilson]

The Go Daddy Root Certificate Authority - G2 and the Starfield Root Certificate Authority - G2 are not enabled for email issuance in NSS.

None of the four certificates are trusted in NSS for code signing.

So here are the only two root certificates affected by this request:

CA Name	SHA 256 Hash
GoDaddy Class 2 Certification Authority	C3846BF24B9E93CA64274C0EC67C1ECC5E024FFCACD2D74019350E81FE546AE4
Starfield Class 2 Certification Authority	1465FA205397B876FAA6F0A9958E5590E40FCC7FAA4FB7C2C8677521FB5FB658

Comment 2

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1943135 - Disable SMIME 'trust bit' for GoDaddy CAs. r=bwilson

Comment 3

[Benjamin Beurdouche [:beurdouche]]

https://hg-edge.mozilla.org/projects/nss/rev/9be3c56d8fd1e3a83410ec80257978db0b6f58c8

Comment 4

[Ben Wilson]

Confirming here that this change has been distributed in Nightly 139.0a1 (2025-04-28)