Certificate populations.

What the live web PKI looks like right now — every unexpired certificate, by CA, key type and lifetime.

1.61B active (unexpired) certificates · as of 2026-08-03 21:12 UTC

By certificate authority

Grouped by issuer organization; top 31 shown, the rest folded into “Other CAs”.

CA ownerCertificatesShare
Let's Encrypt 631.1M
Google Trust Services 322.4M
Amazon 189.2M
ZeroSSL GmbH 106.8M
GoDaddy.com 92.8M
Microsoft Corporation 70.1M
GoDaddy.com, Inc. 60.7M
DigiCert Inc 43.4M
Sectigo Limited 39M
SSL Corporation 20.4M
IdenTrust 17.5M
GlobalSign nv-sa 1.6M
Actalis S.p.A. 1.5M
TrustAsia Technologies, Inc. 1.5M
DigiCert, Inc. 1M
Hellenic Academic and Research Institutions CA 955.6K
Meraki LLC 671.2K
Google UK Ltd. 468.8K
Gandi SAS 418K
Starfield Technologies, Inc. 334.7K
cPanel, LLC 306.3K
Internet2 284.3K
Asseco Data Systems S.A. 224.3K
home.pl S.A. 193K
Certainly 155.5K
Entrust Limited 128.1K
Japan Registry Services Co., Ltd. 124.6K
Starfield Technologies 121.1K
InCommon, LLC 118.6K
GoGetSSL 95.5K
Other CAs 1.7M

By public-key type

Signature key algorithm and strength of the active population.

Key typeCertificatesShare
RSA 2048 812.3M
ECDSA P-256 602.4M
ECDSA P-384 107.2M
RSA 4096 79.2M
RSA 3072 4.4M
RSA (other) 2.5K
ECDSA P-521 566

By validity lifetime

Days from notBefore to notAfter — the industry is moving toward ever-shorter certificates.

LifetimeCertificatesShare
≤ 10 days 2.7M
11–47 days 17M
48–90 days 1.12B
91–100 days 18.6M
101–200 days 290.1M
201–398 days 153.9M
> 398 days 75.2K

Counts cover only currently-unexpired certificates and are approximate (deduplicated with a HyperLogLog estimator, sub-percent error). CA/precertificate pairs are counted once. Refreshed every few hours.