Country · October 2026
ChinaChina's top sites: post-quantum TLS, October 2026
The 997 most visited sites in China — the top-1,000 popularity bucket of the Chrome UX Report for September 2026 — scanned on with the same scanner as the rest of the issue. 963 of them completed a handshake.
The Chrome UX Report only sees Chrome users who share usage statistics. In China Google services are blocked and Chrome is a minority browser, so this list describes a small and unrepresentative slice of the country's web — read its numbers with that in mind.
- 63.2%
- negotiate X25519MLKEM768
- 55.1%
- sign with ECDSA
- 87.9%
- negotiate TLS 1.3
- 61.5%
- still accept TLS 1.0 or 1.1
- 0.2%
- meet the 2029 lifetime rule
- 33.3%
- graded A or A+
7 of 9 countries; the world list: 58.7%
the world list: 41%
the world list: 84.8%
the world list: 29.5%
median lifetime: 90 days
the world list: 61.6%
Compared with the other countries
The same figures for every country list of the issue and for the world list.
| List | Measured | X25519MLKEM768 | ECDSA | TLS 1.3 | TLS 1.0/1.1 | A or A+ |
|---|---|---|---|---|---|---|
| Tranco top 10,000 | 7,909 | 58.7% | 41% | 84.8% | 29.5% | 61.6% |
| Mexico | 942 | 77% | 50.3% | 92.5% | 32.9% | 60.8% |
| Brazil | 971 | 73.6% | 52.9% | 90.4% | 38.6% | 56.5% |
| France | 988 | 73.1% | 48.7% | 93.8% | 23.5% | 72.2% |
| Germany | 999 | 72.8% | 51.8% | 94.8% | 24.8% | 72.3% |
| Spain | 991 | 68.4% | 40.1% | 87% | 23.6% | 66.1% |
| Taiwan | 947 | 66.8% | 46.7% | 85.9% | 43.7% | 45.2% |
| China | 963 | 63.2% | 55.1% | 87.9% | 61.5% | 33.3% |
| Japan | 969 | 58% | 27.9% | 78.1% | 31.9% | 56.3% |
| Russia | 955 | 27% | 29.8% | 79.3% | 40.4% | 52.5% |
The details
Leaf certificate key algorithms
Share of the 963 domains that completed a handshake.
Show the numbers as a table
| Key family | Domains | Share |
|---|---|---|
| ECDSA | 531 | 55.1% |
| RSA | 432 | 44.9% |
Exact key types
Curve for elliptic-curve keys, modulus size for RSA.
Show the numbers as a table
| Key type | Domains | Share |
|---|---|---|
| ECDSA P-256 | 526 | 54.6% |
| RSA-2048 | 428 | 44.4% |
| ECDSA P-384 | 5 | 0.5% |
| RSA-4096 | 3 | 0.3% |
| RSA-3072 | 1 | 0.1% |
Issuing CAs, and what they issue
Issuing intermediates folded into the operator behind them. The bar is the CA's share; the table shows how the same certificates split between ECDSA and RSA.
Show the numbers as a table
| Certificate authority | Domains | Share |
|---|---|---|
| Google Trust Services | 394 | 40.9% |
| DigiCert | 184 | 19.1% |
| Let's Encrypt | 137 | 14.2% |
| GlobalSign | 89 | 9.2% |
| Other / smaller CAs | 81 | 8.4% |
| Amazon | 36 | 3.7% |
| Sectigo | 18 | 1.9% |
| GoDaddy | 9 | 0.9% |
| Smaller CAs (4) | 15 | 1.5% |
Protocol negotiated by a modern client
What our scanner and the server agreed on when both were free to pick the best available version.
Show the numbers as a table
| TLS version | Domains | Share |
|---|---|---|
| TLS 1.3 | 846 | 87.9% |
| TLS 1.2 | 117 | 12.1% |
Response to a deliberately obsolete handshake
A separate connection per domain, offering nothing above TLS 1.1 (and, where that succeeds, a second one capped at TLS 1.0).
Show the numbers as a table
| Behaviour | Domains | Share |
|---|---|---|
| Accepted TLS 1.0 and TLS 1.1 | 559 | 58% |
| Refused TLS 1.0 and 1.1 | 371 | 38.5% |
| Accepted TLS 1.1 | 33 | 3.4% |
Certificate lifetime distribution
Total notBefore → notAfter validity of the leaf certificate, for the 963 domains measured. The highlighted bucket is the one that already satisfies the 2029 limit.
Show the numbers as a table
| Lifetime | Domains | Share |
|---|---|---|
| ≤ 47 days | 2 | 0.2% |
| 48–100 days | 559 | 58% |
| 101–200 days | 256 | 26.6% |
| 201–398 days | 146 | 15.2% |
| > 398 days | 0 | 0% |
90 days
median lifetime; the mean is 162.8 days, the shortest 30 and the longest 397
58.3%
would already satisfy the 100-day cap that starts in March 2027
0.2%
would already satisfy the 47-day cap that starts in March 2029 — 2 certificates in total
Grade distribution
All 963 domains that completed a handshake.
Show the numbers as a table
| Grade | Domains | Share |
|---|---|---|
| A+ | 115 | 11.9% |
| A | 206 | 21.4% |
| B | 79 | 8.2% |
| C | 549 | 57% |
| D | 14 | 1.5% |
| F | 0 | 0% |
Most frequent findings
Every observation the grader made, ranked by how many domains it applied to. Green is praise, amber is a deduction, red is disqualifying.
Show the numbers as a table
| Finding | Domains | Share |
|---|---|---|
| Classical algorithm — migration ahead | 963 | 100% |
| Chain complete as served | 961 | 99.8% |
| Within validity period | 924 | 96% |
| TLS 1.3 negotiated | 846 | 87.9% |
| TLS 1.0 accepted | 559 | 58% |
| Lifetime of 90 days or less | 548 | 56.9% |
| Modern key (ECDSA / EdDSA) | 531 | 55.1% |
| RSA-2048 — fine, but not compact | 428 | 44.4% |
| Legacy TLS refused | 371 | 38.5% |
| TLS 1.3 not offered | 117 | 12.1% |
| SHA-1 signature above the leaf | 35 | 3.6% |
| TLS 1.1 accepted | 33 | 3.4% |
Why domains dropped out
Share of the 34 domains that produced no result. One attempt each — the scanner never retries.
Show the numbers as a table
| Reason | Domains | Share |
|---|---|---|
| No public DNS answer | 15 | 44.1% |
| Resolves to reserved address space | 8 | 23.5% |
| No handshake before the timeout | 8 | 23.5% |
| Port 443 refused or reset | 3 | 8.8% |
Data
The hosts behind these numbers are rows of the issue's per-host CSV whose crux_countries column contains cn. Country lists come from the Chrome UX Report by Google (CC BY 4.0); the results are licensed under CC BY 4.0.
Where does your domain sit?
Every number on this page came out of a scan you can run yourself, one domain at a time, for free.