We have several Rackspace Windows servers (2008 R2), each running 4/5 e-commerce websites, each with their own SSL certificates from Go Daddy.

We accept PayPal payments on these websites and use IPN to get notified when a transaction happens.

Google Chrome (as of now) has no problem with our certificates, and we get a nice green padlock shown. However PayPal now requires two things:

  1. SHA-256
  2. G5 Root Certificate

...as shown here: https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1766&viewlocale=en_US&direct=en

I think that all our certificates are SHA-256, but I don't know how to move to using G5 (rather than G2).

An example certificate can be found here: http://www.crusadergifts.co.uk/ (go to Account > Signin to hit a HTTPS URL).

In the certificate hierarchy on the server (in IIS) I can see this for one of our certificates:

  • Go Daddy Class 2 Certification Authority
  • ...Go Daddy Root Certificate Authority - G2
  • ......Go Daddy Secure Certificate Authority - G2
  • .........[The name of our certificate in IIS]

When I go go:

  1. mmc
  2. File > Add/remove snap-in
  3. Certificates (Local Computer)
  4. Trusted Root Certification Authorities
  5. Certificates

I can see both:

  • Go Daddy Class 2 Certification Authority
  • VeriSign Class 3 Public Primary Certification Authority - G5

So my question is... How do I move my certificates over from G2 to G5 so that PayPal accepts them as valid certificates..??

1 Answer 1


PayPal is requiring the discontinue use of the VeriSign G2 Root Certificate. That is not the same as the GoDaddy G2 root.

If there is a requirement to use the Verisign root then you have to get a Verisign issued certificate. Your current certificate is issued by GoDaddy not Verisign. You can't chain a GoDaddy cert to a Verisign root.

  • I'm struggling with all this to be honest. So are you suggesting that if PayPal says "PayPal will no longer honor secure connections that require the VeriSign G2 Root. Only secure connection requests that are expecting our certificate/trust chain to be signed by the G5 Root Certificate will result in successful connections." ...then we need to delete all our SSL certificates and buy new ones from Verisign..?? ...or are you suggesting that the GoDaddy G2 root should work fine (only the VeriSign G2 root will not be supported)..?? ...or should we be contacting GoDaddy about a GoDaddy G5..?? Jan 25, 2016 at 16:40
  • I dont know how paypal's system is set up. I suggest you call paypal support and work it out with them. Jan 25, 2016 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.