SSL/TLS data reports

What the reports cover

Each report covers the TLS versions sites negotiate, the share of each certificate authority, certificate lifetimes, expired certificates, missing intermediate certificates, HSTS adoption, key types and post-quantum key exchange, measured the same way every month so the numbers can be compared over time.

Method

• Sample: the first N domains of the Tranco list. Tranco combines several popularity rankings averaged over 30 days and is designed for research use.
• Scan: on the 1st of each month from the ssl.sh server, one TLS handshake to port 443 per domain, using the same engine as the SSL checker in quick mode (handshake, certificate parsing, chain and hostname validation). If the bare domain fails or its certificate does not match, www. is tried once. After a successful handshake one GET request to the home page reads the Strict-Transport-Security header; redirects are not followed and the body is not read.
• Rate limits: at most 32 concurrent connections, 20 new connections per second and an 8-second timeout.
• What we keep: statistical fields only (TLS version, cipher, issuer, key type, dates and check results). No certificate PEM, no IP addresses, no page content.
• Denominators: TLS versions use domains that completed a handshake; CA share and lifetimes use publicly trusted certificates; expiry, days left and key types use every domain that returned a certificate; incomplete chains use domains where the chain could be evaluated; HSTS uses trusted, hostname-matching sites whose home page answered.
• Limitations: a single vantage point, so CDNs may serve different certificates elsewhere; Tranco contains many domains that serve no website (CDN and API hosts), and those count as connection errors.