By certificate authority
Grouped by issuer organization; top 31 shown, the rest folded into “Other CAs”.
| CA owner | Certificates | Share |
|---|---|---|
| Let's Encrypt | 631.1M | |
| Google Trust Services | 322.4M | |
| Amazon | 189.2M | |
| ZeroSSL GmbH | 106.8M | |
| GoDaddy.com | 92.8M | |
| Microsoft Corporation | 70.1M | |
| GoDaddy.com, Inc. | 60.7M | |
| DigiCert Inc | 43.4M | |
| Sectigo Limited | 39M | |
| SSL Corporation | 20.4M | |
| IdenTrust | 17.5M | |
| GlobalSign nv-sa | 1.6M | |
| Actalis S.p.A. | 1.5M | |
| TrustAsia Technologies, Inc. | 1.5M | |
| DigiCert, Inc. | 1M | |
| Hellenic Academic and Research Institutions CA | 955.6K | |
| Meraki LLC | 671.2K | |
| Google UK Ltd. | 468.8K | |
| Gandi SAS | 418K | |
| Starfield Technologies, Inc. | 334.7K | |
| cPanel, LLC | 306.3K | |
| Internet2 | 284.3K | |
| Asseco Data Systems S.A. | 224.3K | |
| home.pl S.A. | 193K | |
| Certainly | 155.5K | |
| Entrust Limited | 128.1K | |
| Japan Registry Services Co., Ltd. | 124.6K | |
| Starfield Technologies | 121.1K | |
| InCommon, LLC | 118.6K | |
| GoGetSSL | 95.5K | |
| Other CAs | 1.7M |
By public-key type
Signature key algorithm and strength of the active population.
| Key type | Certificates | Share |
|---|---|---|
| RSA 2048 | 812.3M | |
| ECDSA P-256 | 602.4M | |
| ECDSA P-384 | 107.2M | |
| RSA 4096 | 79.2M | |
| RSA 3072 | 4.4M | |
| RSA (other) | 2.5K | |
| ECDSA P-521 | 566 |
By validity lifetime
Days from notBefore to notAfter — the industry is moving toward ever-shorter certificates.
| Lifetime | Certificates | Share |
|---|---|---|
| ≤ 10 days | 2.7M | |
| 11–47 days | 17M | |
| 48–90 days | 1.12B | |
| 91–100 days | 18.6M | |
| 101–200 days | 290.1M | |
| 201–398 days | 153.9M | |
| > 398 days | 75.2K |
Counts cover only currently-unexpired certificates and are approximate (deduplicated with a HyperLogLog estimator, sub-percent error). CA/precertificate pairs are counted once. Refreshed every few hours.