Skip to content
ecdsa.com

Country · October 2026

GermanyGermany's top sites: post-quantum TLS, October 2026

The 1,000 most visited sites in Germany — the top-1,000 popularity bucket of the Chrome UX Report for September 2026 — scanned on with the same scanner as the rest of the issue. 999 of them completed a handshake.

72.8%
negotiate X25519MLKEM768

4 of 9 countries; the world list: 58.7%

51.8%
sign with ECDSA

the world list: 41%

94.8%
negotiate TLS 1.3

the world list: 84.8%

24.8%
still accept TLS 1.0 or 1.1

the world list: 29.5%

0.7%
meet the 2029 lifetime rule

median lifetime: 90 days

72.3%
graded A or A+

the world list: 61.6%

Compared with the other countries

The same figures for every country list of the issue and for the world list.

Key figures by list and country
ListMeasuredX25519MLKEM768ECDSATLS 1.3TLS 1.0/1.1A or A+
Tranco top 10,0007,90958.7%41%84.8%29.5%61.6%
Mexico94277%50.3%92.5%32.9%60.8%
Brazil97173.6%52.9%90.4%38.6%56.5%
France98873.1%48.7%93.8%23.5%72.2%
Germany99972.8%51.8%94.8%24.8%72.3%
Spain99168.4%40.1%87%23.6%66.1%
Taiwan94766.8%46.7%85.9%43.7%45.2%
China96363.2%55.1%87.9%61.5%33.3%
Japan96958%27.9%78.1%31.9%56.3%
Russia95527%29.8%79.3%40.4%52.5%

The details

Leaf certificate key algorithms

Share of the 999 domains that completed a handshake.

ECDSA51.8%517RSA48.2%482
Show the numbers as a table
Leaf certificate key algorithms
Key familyDomainsShare
ECDSA51751.8%
RSA48248.2%

Exact key types

Curve for elliptic-curve keys, modulus size for RSA.

ECDSA P-25650.5%504RSA-204841.8%418RSA-40965.3%53ECDSA P-3841.3%13RSA-30721.1%11
Show the numbers as a table
Exact key types on leaf certificates
Key typeDomainsShare
ECDSA P-25650450.5%
RSA-204841841.8%
RSA-4096535.3%
ECDSA P-384131.3%
RSA-3072111.1%

Issuing CAs, and what they issue

Issuing intermediates folded into the operator behind them. The bar is the CA's share; the table shows how the same certificates split between ECDSA and RSA.

Google Trust Services29.1%291Let's Encrypt27.7%277DigiCert16.3%163Amazon11.2%112Sectigo6.1%61Other / smaller CAs4.3%43GlobalSign2.7%27Certum0.7%7Smaller CAs (4)1.8%18
Show the numbers as a table
Certificate authorities by share of the sample
Certificate authorityDomainsShare
Google Trust Services29129.1%
Let's Encrypt27727.7%
DigiCert16316.3%
Amazon11211.2%
Sectigo616.1%
Other / smaller CAs434.3%
GlobalSign272.7%
Certum70.7%
Smaller CAs (4)181.8%

Protocol negotiated by a modern client

What our scanner and the server agreed on when both were free to pick the best available version.

TLS 1.394.8%947TLS 1.25.2%52
Show the numbers as a table
Negotiated TLS version
TLS versionDomainsShare
TLS 1.394794.8%
TLS 1.2525.2%

Response to a deliberately obsolete handshake

A separate connection per domain, offering nothing above TLS 1.1 (and, where that succeeds, a second one capped at TLS 1.0).

Refused TLS 1.0 and 1.175.2%751Accepted TLS 1.0 and TLS 1.124.6%246Accepted TLS 1.10.2%2
Show the numbers as a table
Server response to a handshake capped at TLS 1.1 or lower
BehaviourDomainsShare
Refused TLS 1.0 and 1.175175.2%
Accepted TLS 1.0 and TLS 1.124624.6%
Accepted TLS 1.120.2%

Certificate lifetime distribution

Total notBefore → notAfter validity of the leaf certificate, for the 999 domains measured. The highlighted bucket is the one that already satisfies the 2029 limit.

0.7%≤ 47 days759.3%48–100 days59228.3%101–200 days28311.7%201–398 days1170%> 398 days0
Show the numbers as a table
Certificate lifetime distribution in days
LifetimeDomainsShare
≤ 47 days70.7%
48–100 days59259.3%
101–200 days28328.3%
201–398 days11711.7%
> 398 days00%

90 days

median lifetime; the mean is 154.2 days, the shortest 23 and the longest 397

60%

would already satisfy the 100-day cap that starts in March 2027

0.7%

would already satisfy the 47-day cap that starts in March 2029 — 7 certificates in total

Grade distribution

All 999 domains that completed a handshake.

A+23%230A49.2%492C24.3%243
Show the numbers as a table
Distribution of A+ to F grades
GradeDomainsShare
A+23023%
A49249.2%
B313.1%
C24324.3%
D30.3%
F00%

Most frequent findings

Every observation the grader made, ranked by how many domains it applied to. Green is praise, amber is a deduction, red is disqualifying.

Chain complete as served100%999Classical algorithm — migration ahead100%999Within validity period95%949TLS 1.3 negotiated94.8%947Legacy TLS refused75.2%751Lifetime of 90 days or less58.4%583Modern key (ECDSA / EdDSA)51.8%517RSA-2048 — fine, but not compact41.8%418TLS 1.0 accepted24.6%246RSA above 2048 bits6.4%64TLS 1.3 not offered5.2%52In the renewal window (< 30 days)4.1%41
Show the numbers as a table
Most frequent grader findings
FindingDomainsShare
Chain complete as served999100%
Classical algorithm — migration ahead999100%
Within validity period94995%
TLS 1.3 negotiated94794.8%
Legacy TLS refused75175.2%
Lifetime of 90 days or less58358.4%
Modern key (ECDSA / EdDSA)51751.8%
RSA-2048 — fine, but not compact41841.8%
TLS 1.0 accepted24624.6%
RSA above 2048 bits646.4%
TLS 1.3 not offered525.2%
In the renewal window (< 30 days)414.1%

Why domains dropped out

Share of the 1 domains that produced no result. One attempt each — the scanner never retries.

No handshake before the timeout100%1
Show the numbers as a table
Reasons domains produced no measurement
ReasonDomainsShare
No handshake before the timeout1100%

Data

The hosts behind these numbers are rows of the issue's per-host CSV whose crux_countries column contains de. Country lists come from the Chrome UX Report by Google (CC BY 4.0); the results are licensed under CC BY 4.0.

The October 2026 issue

Where does your domain sit?

Every number on this page came out of a scan you can run yourself, one domain at a time, for free.

Domain check

Grade your own domain

The same scan, the same grader, your certificate — plus free alerts before it expires.

README badges

Put the grade in your README

A live badge for your project: current grade, TLS version, days until the certificate expires.