subscribersgodaddyssl

REPORTOFINDEPENDENTCERTIFIEDPUBLICACCOUNTANTSTotheManagementofStarfieldTechnologies,LLC:ScopeWehaveexaminedtheassertionbythemanagementofStarfieldTechnologies,LLC("Starfield")thatinprovidingitsStarfieldandGoDaddySSLCertificationAuthority(CA)servicesatitsScottsdale,Arizona,USA,andPhoenix,Arizona,USA,locations,throughouttheperiodfromJuly1,2018,toJune30,2019,foritsrootandsubordinateCAcertificatesaslistedinAppendixA,Starfieldhas:DiscloseditsSSLCertificatepracticesandproceduresinits:CertificatePolicyandCertificationPracticeStatement(v4.
1);andAutomatedDomainValidationProceduresincludingitscommitmenttoprovideSSLCertificatesinconformitywiththeapplicableCA/BrowserForumRequirements;Maintainedeffectivecontrolstoprovidereasonableassurancethat:Subscriberinformationwasproperlycollected,authenticated(fortheregistrationactivitiesperformedbytheCA)andverified;Theintegrityofkeysandcertificatesitmanagesisestablishedandprotectedthroughouttheirlifecycles;Maintainedeffectivecontrolstoprovidereasonableassurancethat:LogicalandphysicalaccesstoCAsystemsanddataisrestrictedtoauthorizedindividuals;Thecontinuityofkeyandcertificatemanagementoperationswasmaintained;CAsystemsdevelopment,maintenanceandoperationsareproperlyauthorizedandperformedtomaintainCAsystemsintegrity;andMaintainedeffectivecontrolstoprovidereasonableassurancethat:NetworkandCertificateSystemSecurityRequirementssetforthbytheCA/BrowserForumweremetbasedontheWebTrustPrinciplesandCriteriaforCertificationAuthorities–SSLBaselinewithNetworkSecurity–Version2.
3.
Starfield'sResponsibilitiesStarfield'smanagementisresponsibleforitsassertion.
Ourresponsibilityistoexpressanopiniononmanagement'sassertionbasedonourexamination.
TherelativeeffectivenessandsignificanceofspecificcontrolsatStarfieldandtheireffectonassessmentsofcontrolriskforsubscribersandrelyingpartiesaredependentontheirinteractionwiththecontrolsandotherfactorspresentatindividualsubscriberandrelyingpartylocations.
Ourexaminationdidnotextendtocontrolsatindividualsubscriberandrelyingpartylocationsandwehavenotevaluatedtheeffectivenessofsuchcontrols.
IndependentCertifiedPublicAccountant'sResponsibilitiesOurexaminationwasconductedinaccordancewithattestationstandardsestablishedbytheAmericanInstituteofCertifiedPublicAccountants.
Thosestandardsrequirethatweplanandperformtheexaminationtoobtainreasonableassuranceaboutwhethermanagement'sassertionisfairlystated,inallmaterialrespects.
Anexaminationinvolvesperformingprocedurestoobtainevidenceaboutmanagement'sassertion.
Thenature,timing,andextentoftheproceduresselecteddependonourjudgment,includinganassessmentoftherisksofmaterialmisstatementofmanagement'sassertion,whetherduetofraudorerror.
Webelievethattheevidenceweobtainedissufficientandappropriatetoprovideareasonablebasisforouropinion.
InherentLimitationsBecauseofthenatureandinherentlimitationsofcontrols,Starfield'sabilitytomeettheaforementionedcriteriamaybeaffected.
Forexample,controlsmaynotprevent,ordetectandcorrect,error,fraud,unauthorizedaccesstosystemsandinformation,orfailuretocomplywithinternalandexternalpoliciesorrequirements.
Also,theprojectionofanyconclusionsbasedonourfindingstofutureperiodsissubjecttotheriskthatchangesmayalterthevalidityofsuchconclusions.
OpinionInouropinion,Starfield'smanagement'sassertion,asreferredtoabove,isfairlystated,inallmaterialrespects.
ThisreportdoesnotincludeanyrepresentationastothequalityofStarfield'sservicesotherthanitsCAoperationsatitsScottsdale,Arizona,USA,andPhoenix,Arizona,USA,locations,northesuitabilityofanyofStarfield'sservicesforanycustomer'sintendedpurpose.
Starfield'suseoftheWebTrustPrinciplesandCriteriaforCertificationAuthorities–SSLBaselinewithNetworkSecuritySealconstitutesasymbolicrepresentationofthecontentsofthisreportanditisnotintended,norshoulditbeconstrued,toupdatethisreportorprovideanyadditionalassurance.
Schellman&Company,LLCCertifiedPublicAccountantsTampa,FloridaAugust14,2019ASSERTIONOFMANAGEMENTASTOITSDISCLOSUREOFITSPRACTICESANDITSCONTROLSOVERITSSSLCERTIFICATIONAUTHORITYOPERATIONSDURINGTHEPERIODJULY1,2018,TOJUNE30,2019StarfieldTechnologies,LLC("Starfield")operatestheCertificationAuthority(CA)servicesknownasStarfieldandGoDaddyandprovidesSSLCAservices.
ManagementhasassessedthecontrolsoveritsStarfieldandGoDaddySSLCAservices.
Basedonthatassessment,inStarfieldmanagement'sopinion,inprovidingitsCAservicesatitsScottsdale,Arizona,USA,andPhoenix,Arizona,USA,locationsthroughouttheperiodfromJuly1,2018,toJune30,2019,foritsrootandsubordinateCAcertificatesaslistedinAppendixA,Starfieldhas:DiscloseditsSSLCertificatepracticesandproceduresandits:CertificatePolicyandCertificationPracticeStatement(v4.
1);andAutomatedDomainValidationProceduresincludingitscommitmenttoprovideSSLCertificatesinconformitywiththeapplicableCA/BrowserForumRequirements;Maintainedeffectivecontrolstoprovidereasonableassurancethat:Subscriberinformationwasproperlycollected,authenticated(fortheregistrationactivitiesperformedbytheCA)andverified;Theintegrityofkeysandcertificatesitmanagesisestablishedandprotectedthroughouttheirlifecycles;Maintainedeffectivecontrolstoprovidereasonableassurancethat:LogicalandphysicalaccesstoCAsystemsanddataisrestrictedtoauthorizedindividuals;Thecontinuityofkeyandcertificatemanagementoperationswasmaintained;CAsystemsdevelopment,maintenanceandoperationsareproperlyauthorizedandperformedtomaintainCAsystemsintegrity;andMaintainedeffectivecontrolstoprovidereasonableassurancethat:NetworkandCertificateSystemSecurityRequirementssetforthbytheCA/BrowserForumweremetbasedontheWebTrustPrinciplesandCriteriaforCertificationAuthorities–SSLBaselinewithNetworkSecurity–Version2.
3.
NimaKellyChiefLegalOfficerStarfieldTechnologies,LLCAugust14,2019APPENDIXA–STARFIELDANDGODADDYROOTANDISSUINGCASNameCertificateThumbprint(sha256)GoDaddyClass2CertificationAuthorityC3:84:6B:F2:4B:9E:93:CA:64:27:4C:0E:C6:7C:1E:CC:5E:02:4F:FC:AC:D2:D7:40:19:35:0E:81:FE:54:6A:E4GoDaddyRootCertificateAuthority-G245:14:0B:32:47:EB:9C:C8:C5:B4:F0:D7:B5:30:91:F7:32:92:08:9E:6E:5A:63:E2:74:9D:D3:AC:A9:19:8E:DAGoDaddyRootCertificateAuthority-G351:A4:90:F8:52:32:D9:15:E3:EA:E3:DF:69:58:11:A7:4D:1F:AE:BE:3B:47:EC:43:A5:8D:88:1D:44:DB:43:71GoDaddyRootCertificateAuthority-G4C1:A2:7E:CB:DF:9C:BB:3E:11:2C:B0:39:CB:3A:C9:E4:18:B6:C5:28:D2:82:2F:FB:68:C9:C7:26:18:50:BC:41GoDaddySecureCertificationAuthority(IntermediateCertificate)09:ED:6E:99:1F:C3:27:3D:8F:EA:31:7D:33:9C:02:04:18:61:97:35:49:CF:A6:E1:55:8F:41:1F:11:21:1A:A3GoDaddySecureCertificateAuthority-G2(IntermediateCertificate)97:3A:41:27:6F:FD:01:E0:27:A2:AA:D4:9E:34:C3:78:46:D3:E9:76:FF:6A:62:0B:67:12:E3:38:32:04:1A:A6GoDaddySecureCertificateAuthority-G3(IntermediateCertificate)91:B4:5F:D0:47:E5:47:76:42:80:6D:93:B7:6E:76:DD:30:8A:20:2C:75:4D:94:63:37:33:40:95:77:AF:97:13GoDaddySecureCertificateAuthority-G4(IntermediateCertificate)CB:35:EE:A6:B7:8C:EF:D6:7E:7D:C7:FE:6F:A3:B3:8D:FD:60:1D:90:3F:A2:92:66:B3:4C:83:94:11:54:1C:8CGoDaddyRootCertificateAuthority-G2(Cross-SignedCertificate)3A:2F:BE:92:89:1E:57:FE:05:D5:70:87:F4:8E:73:0F:17:E5:A5:F5:3E:F4:03:D6:18:E5:B7:4D:7A:7E:6E:CBGoDaddyRootCertificateAuthority-G2(Cross-SignedCertificate)9B:F5:89:67:54:59:96:19:45:12:DB:61:77:15:1A:FE:99:70:6A:EA:3D:A3:6F:EE:E7:AD:9F:8B:3C:05:07:CBStarfieldClass2CertificationAuthority14:65:FA:20:53:97:B8:76:FA:A6:F0:A9:95:8E:55:90:E4:0F:CC:7F:AA:4F:B7:C2:C8:67:75:21:FB:5F:B6:58StarfieldRootCertificateAuthority-G22C:E1:CB:0B:F9:D2:F9:E1:02:99:3F:BE:21:51:52:C3:B2:DD:0C:AB:DE:1C:68:E5:31:9B:83:91:54:DB:B7:F5StarfieldRootCertificateAuthority-G36D:7F:24:45:B8:4A:BB:08:2C:5D:09:2A:B4:61:77:28:2B:AC:96:EE:2B:A3:7F:EA:8A:1C:9A:30:A0:78:0C:1EStarfieldRootCertificateAuthority-G4F3:7B:58:62:4F:F8:38:B8:F4:8C:E1:7A:53:44:A1:55:78:D7:11:2A:B4:9F:4A:A2:A9:92:12:EC:63:60:51:58StarfieldServicesRootCertificateAuthorityB5:BD:2C:B7:9C:BD:19:07:29:8D:6B:DF:48:42:E5:16:D8:C7:8F:A6:FC:96:D2:5F:71:AF:81:4E:16:CC:24:5EStarfieldSecureCertificationAuthority(IntermediateCertificate)05:A6:DB:38:93:91:DF:92:E0:BE:93:FD:FA:4D:B1:E3:CF:53:90:39:18:B8:D9:D8:5A:9C:39:6C:B5:5D:F0:30StarfieldSecureCertificateAuthority-G2(IntermediateCertificate)93:A0:78:98:D8:9B:2C:CA:16:6B:A6:F1:F8:A1:41:38:CE:43:82:8E:49:1B:83:19:26:BC:82:47:D3:91:CC:72StarfieldSecureCertificateAuthority-G3(IntermediateCertificate)51:BD:25:07:21:CE:5C:B9:25:2A:60:DC:9E:7B:32:76:39:94:89:CC:4E:0C:90:14:40:11:5F:61:7D:B2:04:E6StarfieldSecureCertificateAuthority-G4(IntermediateCertificate)F7:E1:8A:5B:AD:66:1F:6E:24:AA:52:1D:E9:98:A8:6E:8D:7D:38:5A:D2:78:43:7C:47:3C:08:05:73:4A:64:6BStarfieldRootCertificateAuthority-G2(Cross-SignedCertificate)9F:43:D5:2E:80:8C:20:AF:F6:9E:02:FA:AC:20:5A:AC:68:4E:69:75:21:3D:66:20:FA:C6:4B:DE:5F:CA:B4:BCNameCertificateThumbprint(sha256)StarfieldRootCertificateAuthority-G2(Cross-SignedCertificate)45:40:40:E4:96:90:70:40:1C:C3:5B:DF:7F:2A:4E:BC:E5:79:7B:B7:69:4A:E7:31:D9:3A:81:15:FD:59:92:9CStarfieldServicesRootCertificateAuthority-G2(Cross-SignedCertificate)EB:15:9C:92:2A:3F:C2:19:14:75:CA:20:A5:38:16:D8:7A:38:A1:A7:9A:72:64:78:91:93:D2:F1:F7:50:E8:5EStarfieldServicesRootCertificateAuthority-G2(Cross-SignedCertificate)A2:4B:94:40:F9:FC:BE:BB:48:C2:74:C0:3D:E7:D2:4C:5E:D1:CA:59:D2:D3:62:F2:9E:D3:B4:57:76:2C:75:BBStarfieldServicesRootCertificateAuthority-G2(Cross-SignedCertificate)2D:12:B6:19:A6:60:CE:FB:01:32:71:83:1D:89:12:13:FC:43:4E:98:2A:21:56:82:56:CF:4E:2E:86:32:4B:EAStarfieldServicesRootCertificateAuthority-G2(Cross-SignedCertificate)28:68:9B:30:E4:C3:06:AA:B5:3B:02:7B:29:E3:6A:D6:DD:1D:CF:4B:95:39:94:48:2C:A8:4B:DC:1E:CA:C9:96Thecross-signedcertificatesweresignedwithakeycontrolledbyStarfield,andthecertificatesaresubjecttotheStarfieldCP/CPS.
Whilethecross-signingestablishesatrustedrelationship,theexaminationbySchellman&Company,LLCdidnotextendtothecontrolsexercisedorcertificatesissuedbyanythirdpartiesorexternalregistrationauthorities.