# SSL Root Certificate Distrust Checker (15 April 2027) (`donrulezz/root-certificate-distrust-checker`) Actor

On 15 April 2027 Mozilla stops trusting 19 old roots (Go Daddy G2, Starfield G2, USERTrust, COMODO, GlobalSign R3...). Check which sites, APIs and mail servers then fail in Firefox, curl, Python and Node.js, and which certificates are renewed by hand before the 100-day limit.

- **URL**: https://apify.com/donrulezz/root-certificate-distrust-checker.md
- **Developed by:** [Ashish Agarwal](https://apify.com/donrulezz) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.40 / 1,000 host checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SSL Root Certificate Distrust Checker (15 April 2027)

On **15 April 2027 Mozilla stops trusting 19 old root certificates for websites**, under its rule that roots whose key
material is more than 15 years old lose websites trust ([Mozilla Root CA Lifecycles](https://wiki.mozilla.org/CA/Root_CA_Lifecycles)).
They include **Go Daddy Root Certificate Authority – G2, Starfield Root Certificate Authority – G2, Starfield Services
Root – G2, USERTrust RSA and ECC, COMODO RSA and ECC, and GlobalSign Root CA – R3**.

Firefox, and the many tools that ship Mozilla's root list — **curl and OpenSSL on most Linux distributions, Python
(`requests` / `certifi`), Node.js, Docker images, CI runners** — will then reject any certificate chain that can only
reach one of those roots. Websites, APIs, webhooks and mail servers fail with certificate errors for exactly those clients.

This Actor checks your hosts **now** and tells you which ones break on 15 April 2027.

### How it decides

1. It connects to each host (TLS, or STARTTLS on ports 25/587) and reads the **certificate chain the server sends**.
2. It runs **real WebPKI path validation** (the `cryptography` library's verifier, hostname included) twice:
   against **today's Mozilla root store** and against the **same store without the 19 roots removed on 15 April 2027**.
3. Verdict per host:
   - `ok` — still validates after the removals (often through a newer cross-signed root, e.g. Sectigo R46).
   - `breaks-2027-04-15` — validates today but only through a root that is being removed.
   - `invalid-today` — the chain already fails today (expired, wrong hostname, missing intermediate...).
   - `unreachable` — no TLS connection (not charged).

When the server already sends the CA's **newer root that Mozilla doesn't trust yet** (for example GoDaddy's
"GoDaddy TLS Root CA – R1", not in Mozilla's store as of 27 Oct 2026), the result says so: if Mozilla adds that root
before April 2027 and clients update, the chain keeps working.

### Input

```json
{ "hosts": ["www.example.com", "api.example.com:8443", "mail.example.com:587"] }
```

### Output

```json
{
  "host": "www.godaddy.com",
  "port": 443,
  "verdict": "breaks-2027-04-15",
  "validToday": true,
  "validAfter2027RootRemovals": false,
  "anchorRoot": "Go Daddy Root Certificate Authority - G2",
  "anchorRootRemovedOn": "2027-04-15",
  "newerRootNotYetTrusted": ["GoDaddy TLS Root CA - R1"],
  "leafIssuer": "GoDaddy TLS Intermediate CA OV - R1v1",
  "leafNotAfter": "2027-04-30",
  "daysToExpiry": 185,
  "lifetimeDays": 198,
  "validationType": "OV",
  "likelyManualRenewal": true,
  "lifetimeNote": "198-day OV certificate from GoDaddy.com: probably bought and installed by hand. Certificates issued from 15 Mar 2027 last at most 100 days...",
  "chainServed": ["*.godaddy.com", "GoDaddy TLS Intermediate CA OV - R1v1", "GoDaddy TLS Root CA - R1", "Go Daddy Root Certificate Authority - G2"],
  "tlsVersion": "TLSv1.3",
  "action": "This chain only reaches 'Go Daddy Root Certificate Authority - G2', which Mozilla stops trusting for websites on 15 Apr 2027..."
}
```

(Real result from 27 Oct 2026; `sectigo.com` in the same run is `ok` through Sectigo Public Server Authentication Root R46.)

### What to do with a `breaks-2027-04-15` host

- Ask your certificate authority for a chain to one of its **newer roots** and install the cross-signed intermediate it
  provides, or reissue the certificate from a CA whose root stays trusted.
- Do it well before April 2027: certificates you buy now often run past that date, and many clients (servers, scripts,
  containers) update their root lists only with OS or library updates.
- Re-run the Actor after the change; `ok` means you're done.

### Pricing

Pay per host checked. Hosts that can't be reached are free, and the run stops at your spending limit.

### Good to know

- The root list is Mozilla's, as shipped in `certifi` 2026.07.22 (121 roots today, 102 after the removals). Microsoft,
  Apple and Google keep separate lists and timelines; Chrome uses its own Chrome Root Store.
- Firefox can sometimes build an alternative path through its preloaded intermediates; scripts, servers and containers
  only see the chain your server sends, which is what this check validates.
- **Second 2027 deadline, same run: 100-day certificates.** Certificates issued from 15 March 2027 last at most 100 days
  (47 days from 15 March 2029; [CA/Browser Forum Baseline Requirements](https://github.com/cabforum/servercert/blob/main/docs/BR.md)
  6.3.2). `likelyManualRenewal` flags long-lived certificates (OV/EV/DV by policy OID) from CAs that aren't renewing
  them for you, i.e. the ones someone buys and installs by hand: about 4 installs a year after March 2027.
  `lifetimeDays` and `daysToExpiry` are included for every host.

### FAQ

**Is my GoDaddy SSL certificate going to stop working in 2027?**
GoDaddy's own sites checked on 27 Oct 2026 (godaddy.com, starfieldtech.com) chain only to Go Daddy Root Certificate
Authority – G2, which Mozilla removes for websites on 15 April 2027; their servers already send GoDaddy's newer root
("GoDaddy TLS Root CA – R1"), which isn't in Mozilla's store yet. Certificates from the same hierarchy are likely in the
same position. Run this Actor on your domain and re-check closer to the date.

**Which of my SSL certificates will need renewing every 100 days from March 2027?**
Certificates issued from 15 March 2027 can last at most 100 days (CA/Browser Forum Baseline Requirements). Hosts with
`likelyManualRenewal: true` have a long-lived certificate from a CA that isn't renewing it for you, usually a purchased
OV/EV certificate installed by hand. Those need ACME automation or about four manual installs a year. Let's Encrypt and
other 90-day certificates, and managed certificates (AWS, Azure, Google, Cloudflare), are not flagged.

**Which root certificates does Mozilla remove on 15 April 2027?**
COMODO ECC and RSA, USERTrust ECC and RSA, TWCA Root Certification Authority, T-TeleSec GlobalRoot Class 2 and 3,
Certum Trusted Network CA, AC RAIZ FNMT-RCM, NetLock Arany (Class Gold), GlobalSign Root CA – R3, Firmaprofesional CIF
A62634068, Security Communication RootCA2, Microsec e-Szigno Root CA 2009, Starfield Services Root – G2, Go Daddy Root – G2,
Starfield Root – G2, D-TRUST Root Class 3 CA 2 2009 and D-TRUST Root Class 3 CA 2 EV 2009.

**Does this affect Chrome?**
Chrome uses its own root store with its own schedule; this check is about Mozilla's list, which Firefox and most
non-browser clients (curl, Python, Node.js, Linux) use.

**Can it check mail servers?**
Yes: add `host:587` or `host:25` (STARTTLS) or `host:465` / `host:993` (implicit TLS).

### More tools from the same author

- [Google Merchant Center Q\&A Writer](https://apify.com/donrulezz/merchant-center-qa-writer): write the new question_and_answer attribute for every product, as a ready supplemental feed.
- [AI Visibility Monitor](https://apify.com/donrulezz/ai-answer-engine-monitor): does ChatGPT, Perplexity, Claude or Gemini recommend your brand.
- [Shopify Script Tag Shutoff Scanner](https://apify.com/donrulezz/shopify-script-tag-scanner): which apps on a Shopify store stop on 1 March 2027, and legacy customer accounts.
- [PayPal Legacy Button Finder](https://apify.com/donrulezz/paypal-legacy-button-finder): every old PayPal Buy Now / Add to Cart button before PayPal retires them.
- [Azure Classic CDN & Front Door Retirement Checker](https://apify.com/donrulezz/azure-classic-cdn-front-door-checker): hostnames and page assets still on Front Door (classic) or azureedge.net.
- [Drupal Version & End-of-Life Checker](https://apify.com/donrulezz/drupal-version-eol-checker): which sites run Drupal 10 (end of life 9 December 2026) or older.
- [Website 2027 Breakage Audit](https://apify.com/donrulezz/website-2027-breakage-audit): every 2026-2027 deadline (certificates, Shopify, PayPal, Azure, Drupal, PHP) in one report per site.

*Mozilla and Firefox are trademarks of the Mozilla Foundation; CA names are trademarks of their owners. This Actor is independent and not affiliated with Mozilla or any CA.*

# Actor input Schema

## `hosts` (type: `array`):

One per line: example.com, api.example.com:8443, https://shop.example.com, mail.example.com:587 (STARTTLS on 25/587; implicit TLS on 465, 993 and other ports).

## `defaultPort` (type: `integer`):

Used for hosts written without a port.

## `maxConcurrency` (type: `integer`):

How many TLS handshakes run at the same time.

## Actor input object example

```json
{
  "hosts": [
    "www.godaddy.com",
    "api.example.com:8443",
    "mail.example.com:587"
  ],
  "defaultPort": 443,
  "maxConcurrency": 10
}
```

# Actor output Schema

## `overview` (type: `string`):

Verdict, root, issuer and the fix per host.

## `summary` (type: `string`):

Counts per verdict and the list of removed roots.

## `results` (type: `string`):

Everything, including the chain served and SANs.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "hosts": [
        "www.godaddy.com",
        "www.sectigo.com",
        "letsencrypt.org"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("donrulezz/root-certificate-distrust-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "hosts": [
        "www.godaddy.com",
        "www.sectigo.com",
        "letsencrypt.org",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("donrulezz/root-certificate-distrust-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "hosts": [
    "www.godaddy.com",
    "www.sectigo.com",
    "letsencrypt.org"
  ]
}' |
apify call donrulezz/root-certificate-distrust-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,donrulezz/root-certificate-distrust-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/gedAtxzO7LlkcBv0X/builds/747TVEbUScj5ZsKwa/openapi.json