By certificate authority
Grouped by issuer organization; top 31 shown, the rest folded into “Other CAs”.
| CA owner | Certificates | Share |
|---|---|---|
| Let's Encrypt | 676.8M | |
| Google Trust Services | 381.9M | |
| Amazon | 223M | |
| GoDaddy.com | 124.6M | |
| ZeroSSL GmbH | 98.5M | |
| Microsoft Corporation | 61.1M | |
| DigiCert Inc | 40.7M | |
| Sectigo Limited | 32.5M | |
| SSL Corporation | 28.8M | |
| GoDaddy.com, Inc. | 20.3M | |
| IdenTrust | 18.4M | |
| GlobalSign nv-sa | 1.7M | |
| Actalis S.p.A. | 1.6M | |
| TrustAsia Technologies, Inc. | 1.6M | |
| DigiCert, Inc. | 1M | |
| Hellenic Academic and Research Institutions CA | 1M | |
| Meraki LLC | 696.3K | |
| Google UK Ltd. | 456.8K | |
| Gandi SAS | 442.2K | |
| Internet2 | 292.7K | |
| Starfield Technologies, Inc. | 263K | |
| cPanel, LLC | 255.6K | |
| Asseco Data Systems S.A. | 255.4K | |
| Starfield Technologies | 192.5K | |
| home.pl S.A. | 171.8K | |
| Certainly | 149K | |
| Entrust Limited | 129.1K | |
| DigiCert Ireland Limited | 128.9K | |
| Japan Registry Services Co., Ltd. | 123.1K | |
| InCommon, LLC | 108.8K | |
| Other CAs | 1.7M |
By public-key type
Signature key algorithm and strength of the active population.
| Key type | Certificates | Share |
|---|---|---|
| RSA 2048 | 835.5M | |
| ECDSA P-256 | 678.8M | |
| ECDSA P-384 | 131.1M | |
| RSA 4096 | 68.6M | |
| RSA 3072 | 5.1M | |
| RSA (other) | 2.5K | |
| ECDSA P-521 | 679 |
By validity lifetime
Days from notBefore to notAfter — the industry is moving toward ever-shorter certificates.
| Lifetime | Certificates | Share |
|---|---|---|
| ≤ 10 days | 3M | |
| 11–47 days | 15.2M | |
| 48–90 days | 1.22B | |
| 91–100 days | 25.4M | |
| 101–200 days | 355.3M | |
| 201–398 days | 102.5M | |
| > 398 days | 60K |
Counts cover only currently-unexpired certificates and are approximate (deduplicated with a HyperLogLog estimator, sub-percent error). CA/precertificate pairs are counted once. Refreshed every few hours.