By certificate authority
Grouped by issuer organization; top 31 shown, the rest folded into “Other CAs”.
| CA owner | Certificates | Share |
|---|---|---|
| Let's Encrypt | 717.3M | |
| Google Trust Services | 446.8M | |
| Amazon | 253.9M | |
| GoDaddy.com | 133.2M | |
| ZeroSSL GmbH | 89.9M | |
| Microsoft Corporation | 75.2M | |
| Sectigo Limited | 46.7M | |
| SSL Corporation | 35.5M | |
| DigiCert Inc | 34.4M | |
| IdenTrust | 16.4M | |
| GoDaddy.com, Inc. | 4.4M | |
| GlobalSign nv-sa | 1.8M | |
| Actalis S.p.A. | 1.7M | |
| TrustAsia Technologies, Inc. | 1.7M | |
| DigiCert, Inc. | 1.1M | |
| Hellenic Academic and Research Institutions CA | 997.2K | |
| Meraki LLC | 766K | |
| Starfield Technologies | 602.2K | |
| Geomys | 550.1K | |
| Google UK Ltd. | 480.6K | |
| Gandi SAS | 454.7K | |
| Internet2 | 288.7K | |
| Asseco Data Systems S.A. | 261.8K | |
| cPanel, LLC | 216.1K | |
| Starfield Technologies, Inc. | 182.2K | |
| D-Trust GmbH | 141.8K | |
| Certainly | 141.5K | |
| home.pl S.A. | 128.7K | |
| Entrust Limited | 118.1K | |
| Japan Registry Services Co., Ltd. | 110K | |
| Other CAs | 1.8M |
By public-key type
Signature key algorithm and strength of the active population.
| Key type | Certificates | Share |
|---|---|---|
| RSA 2048 | 871.2M | |
| ECDSA P-256 | 770.5M | |
| ECDSA P-384 | 153.6M | |
| RSA 4096 | 66M | |
| RSA 3072 | 6M | |
| RSA (other) | 2.5K | |
| ECDSA P-521 | 720 |
By validity lifetime
Days from notBefore to notAfter — the industry is moving toward ever-shorter certificates.
| Lifetime | Certificates | Share |
|---|---|---|
| ≤ 10 days | 3.8M | |
| 11–47 days | 18.4M | |
| 48–90 days | 1.32B | |
| 91–100 days | 41M | |
| 101–200 days | 412.7M | |
| 201–398 days | 70.5M | |
| > 398 days | 317.6K |
Counts cover only currently-unexpired certificates and are approximate (deduplicated with a HyperLogLog estimator, sub-percent error). CA/precertificate pairs are counted once. Refreshed every few hours.