SSL Root Certificate Distrust Checker (15 April 2027)

On 15 April 2027 Mozilla stops trusting 19 old root certificates for websites, under its rule that roots whose key material is more than 15 years old lose websites trust (Mozilla Root CA Lifecycles). They include Go Daddy Root Certificate Authority – G2, Starfield Root Certificate Authority – G2, Starfield Services Root – G2, USERTrust RSA and ECC, COMODO RSA and ECC, and GlobalSign Root CA – R3.

Firefox, and the many tools that ship Mozilla's root list — curl and OpenSSL on most Linux distributions, Python (requests / certifi), Node.js, Docker images, CI runners — will then reject any certificate chain that can only reach one of those roots. Websites, APIs, webhooks and mail servers fail with certificate errors for exactly those clients.

This Actor checks your hosts now and tells you which ones break on 15 April 2027.

How it decides

1. It connects to each host (TLS, or STARTTLS on ports 25/587) and reads the certificate chain the server sends.
2. It runs real WebPKI path validation (the cryptography library's verifier, hostname included) twice: against today's Mozilla root store and against the same store without the 19 roots removed on 15 April 2027.
3. Verdict per host:
   • ok — still validates after the removals (often through a newer cross-signed root, e.g. Sectigo R46).
   • breaks-2027-04-15 — validates today but only through a root that is being removed.
   • invalid-today — the chain already fails today (expired, wrong hostname, missing intermediate...).
   • unreachable — no TLS connection (not charged).

When the server already sends the CA's newer root that Mozilla doesn't trust yet (for example GoDaddy's "GoDaddy TLS Root CA – R1", not in Mozilla's store as of 27 Oct 2026), the result says so: if Mozilla adds that root before April 2027 and clients update, the chain keeps working.

Input

{ "hosts": ["www.example.com", "api.example.com:8443", "mail.example.com:587"] }

Output

{
  "host": "www.godaddy.com",
  "port": 443,
  "verdict": "breaks-2027-04-15",
  "validToday": true,
  "validAfter2027RootRemovals": false,
  "anchorRoot": "Go Daddy Root Certificate Authority - G2",
  "anchorRootRemovedOn": "2027-04-15",
  "newerRootNotYetTrusted": ["GoDaddy TLS Root CA - R1"],
  "leafIssuer": "GoDaddy TLS Intermediate CA OV - R1v1",
  "leafNotAfter": "2027-04-30",
  "daysToExpiry": 185,
  "lifetimeDays": 198,
  "validationType": "OV",
  "likelyManualRenewal": true,
  "lifetimeNote": "198-day OV certificate from GoDaddy.com: probably bought and installed by hand. Certificates issued from 15 Mar 2027 last at most 100 days...",
  "chainServed": ["*.godaddy.com", "GoDaddy TLS Intermediate CA OV - R1v1", "GoDaddy TLS Root CA - R1", "Go Daddy Root Certificate Authority - G2"],
  "tlsVersion": "TLSv1.3",
  "action": "This chain only reaches 'Go Daddy Root Certificate Authority - G2', which Mozilla stops trusting for websites on 15 Apr 2027..."
}

(Real result from 27 Oct 2026; sectigo.com in the same run is ok through Sectigo Public Server Authentication Root R46.)

What to do with a breaks-2027-04-15 host

• Ask your certificate authority for a chain to one of its newer roots and install the cross-signed intermediate it provides, or reissue the certificate from a CA whose root stays trusted.
• Do it well before April 2027: certificates you buy now often run past that date, and many clients (servers, scripts, containers) update their root lists only with OS or library updates.
• Re-run the Actor after the change; ok means you're done.

Pricing

Pay per host checked. Hosts that can't be reached are free, and the run stops at your spending limit.

Good to know

• The root list is Mozilla's, as shipped in certifi 2026.07.22 (121 roots today, 102 after the removals). Microsoft, Apple and Google keep separate lists and timelines; Chrome uses its own Chrome Root Store.
• Firefox can sometimes build an alternative path through its preloaded intermediates; scripts, servers and containers only see the chain your server sends, which is what this check validates.
• Second 2027 deadline, same run: 100-day certificates. Certificates issued from 15 March 2027 last at most 100 days (47 days from 15 March 2029; CA/Browser Forum Baseline Requirements 6.3.2). likelyManualRenewal flags long-lived certificates (OV/EV/DV by policy OID) from CAs that aren't renewing them for you, i.e. the ones someone buys and installs by hand: about 4 installs a year after March 2027. lifetimeDays and daysToExpiry are included for every host.

FAQ

Is my GoDaddy SSL certificate going to stop working in 2027? GoDaddy's own sites checked on 27 Oct 2026 (godaddy.com, starfieldtech.com) chain only to Go Daddy Root Certificate Authority – G2, which Mozilla removes for websites on 15 April 2027; their servers already send GoDaddy's newer root ("GoDaddy TLS Root CA – R1"), which isn't in Mozilla's store yet. Certificates from the same hierarchy are likely in the same position. Run this Actor on your domain and re-check closer to the date.

Which of my SSL certificates will need renewing every 100 days from March 2027? Certificates issued from 15 March 2027 can last at most 100 days (CA/Browser Forum Baseline Requirements). Hosts with likelyManualRenewal: true have a long-lived certificate from a CA that isn't renewing it for you, usually a purchased OV/EV certificate installed by hand. Those need ACME automation or about four manual installs a year. Let's Encrypt and other 90-day certificates, and managed certificates (AWS, Azure, Google, Cloudflare), are not flagged.

Which root certificates does Mozilla remove on 15 April 2027? COMODO ECC and RSA, USERTrust ECC and RSA, TWCA Root Certification Authority, T-TeleSec GlobalRoot Class 2 and 3, Certum Trusted Network CA, AC RAIZ FNMT-RCM, NetLock Arany (Class Gold), GlobalSign Root CA – R3, Firmaprofesional CIF A62634068, Security Communication RootCA2, Microsec e-Szigno Root CA 2009, Starfield Services Root – G2, Go Daddy Root – G2, Starfield Root – G2, D-TRUST Root Class 3 CA 2 2009 and D-TRUST Root Class 3 CA 2 EV 2009.

Does this affect Chrome? Chrome uses its own root store with its own schedule; this check is about Mozilla's list, which Firefox and most non-browser clients (curl, Python, Node.js, Linux) use.

Can it check mail servers? Yes: add host:587 or host:25 (STARTTLS) or host:465 / host:993 (implicit TLS).

More tools from the same author

• Google Merchant Center Q&A Writer: write the new question_and_answer attribute for every product, as a ready supplemental feed.
• AI Visibility Monitor: does ChatGPT, Perplexity, Claude or Gemini recommend your brand.
• Shopify Script Tag Shutoff Scanner: which apps on a Shopify store stop on 1 March 2027, and legacy customer accounts.
• PayPal Legacy Button Finder: every old PayPal Buy Now / Add to Cart button before PayPal retires them.
• Azure Classic CDN & Front Door Retirement Checker: hostnames and page assets still on Front Door (classic) or azureedge.net.
• Drupal Version & End-of-Life Checker: which sites run Drupal 10 (end of life 9 December 2026) or older.
• Website 2027 Breakage Audit: every 2026-2027 deadline (certificates, Shopify, PayPal, Azure, Drupal, PHP) in one report per site.

Mozilla and Firefox are trademarks of the Mozilla Foundation; CA names are trademarks of their owners. This Actor is independent and not affiliated with Mozilla or any CA.