Skip to content
ecdsa.com

Country · October 2026

SpainSpain's top sites: post-quantum TLS, October 2026

The 1,000 most visited sites in Spain — the top-1,000 popularity bucket of the Chrome UX Report for September 2026 — scanned on with the same scanner as the rest of the issue. 991 of them completed a handshake.

68.4%
negotiate X25519MLKEM768

5 of 9 countries; the world list: 58.7%

40.1%
sign with ECDSA

the world list: 41%

87%
negotiate TLS 1.3

the world list: 84.8%

23.6%
still accept TLS 1.0 or 1.1

the world list: 29.5%

2.6%
meet the 2029 lifetime rule

median lifetime: 198 days

66.1%
graded A or A+

the world list: 61.6%

Compared with the other countries

The same figures for every country list of the issue and for the world list.

Key figures by list and country
ListMeasuredX25519MLKEM768ECDSATLS 1.3TLS 1.0/1.1A or A+
Tranco top 10,0007,90958.7%41%84.8%29.5%61.6%
Mexico94277%50.3%92.5%32.9%60.8%
Brazil97173.6%52.9%90.4%38.6%56.5%
France98873.1%48.7%93.8%23.5%72.2%
Germany99972.8%51.8%94.8%24.8%72.3%
Spain99168.4%40.1%87%23.6%66.1%
Taiwan94766.8%46.7%85.9%43.7%45.2%
China96363.2%55.1%87.9%61.5%33.3%
Japan96958%27.9%78.1%31.9%56.3%
Russia95527%29.8%79.3%40.4%52.5%

The details

Leaf certificate key algorithms

Share of the 991 domains that completed a handshake.

RSA59.9%594ECDSA40.1%397
Show the numbers as a table
Leaf certificate key algorithms
Key familyDomainsShare
RSA59459.9%
ECDSA39740.1%

Exact key types

Curve for elliptic-curve keys, modulus size for RSA.

RSA-204854%535ECDSA P-25639.6%392RSA-30723.4%34RSA-40962.5%25ECDSA P-3840.5%5
Show the numbers as a table
Exact key types on leaf certificates
Key typeDomainsShare
RSA-204853554%
ECDSA P-25639239.6%
RSA-3072343.4%
RSA-4096252.5%
ECDSA P-38450.5%

Issuing CAs, and what they issue

Issuing intermediates folded into the operator behind them. The bar is the CA's share; the table shows how the same certificates split between ECDSA and RSA.

Google Trust Services22.6%224Let's Encrypt18.8%186DigiCert17%168Amazon10.6%105GlobalSign8.7%86Other / smaller CAs8.4%83Sectigo8.1%80Certainly (Fastly)2.5%25Smaller CAs (5)3.4%34
Show the numbers as a table
Certificate authorities by share of the sample
Certificate authorityDomainsShare
Google Trust Services22422.6%
Let's Encrypt18618.8%
DigiCert16817%
Amazon10510.6%
GlobalSign868.7%
Other / smaller CAs838.4%
Sectigo808.1%
Certainly (Fastly)252.5%
Smaller CAs (5)343.4%

Protocol negotiated by a modern client

What our scanner and the server agreed on when both were free to pick the best available version.

TLS 1.387%862TLS 1.213%129
Show the numbers as a table
Negotiated TLS version
TLS versionDomainsShare
TLS 1.386287%
TLS 1.212913%

Response to a deliberately obsolete handshake

A separate connection per domain, offering nothing above TLS 1.1 (and, where that succeeds, a second one capped at TLS 1.0).

Refused TLS 1.0 and 1.176.4%757Accepted TLS 1.0 and TLS 1.122.3%221Accepted TLS 1.11.3%13
Show the numbers as a table
Server response to a handshake capped at TLS 1.1 or lower
BehaviourDomainsShare
Refused TLS 1.0 and 1.175776.4%
Accepted TLS 1.0 and TLS 1.122122.3%
Accepted TLS 1.1131.3%

Certificate lifetime distribution

Total notBefore → notAfter validity of the leaf certificate, for the 991 domains measured. The highlighted bucket is the one that already satisfies the 2029 limit.

2.6%≤ 47 days2643.2%48–100 days42835.7%101–200 days35418.5%201–398 days1830%> 398 days0
Show the numbers as a table
Certificate lifetime distribution in days
LifetimeDomainsShare
≤ 47 days262.6%
48–100 days42843.2%
101–200 days35435.7%
201–398 days18318.5%
> 398 days00%

198 days

median lifetime; the mean is 180.3 days, the shortest 14 and the longest 397

45.8%

would already satisfy the 100-day cap that starts in March 2027

2.6%

would already satisfy the 47-day cap that starts in March 2029 — 26 certificates in total

Grade distribution

All 991 domains that completed a handshake.

A+14.8%147A51.3%508B11.5%114C21.8%216
Show the numbers as a table
Distribution of A+ to F grades
GradeDomainsShare
A+14714.8%
A50851.3%
B11411.5%
C21621.8%
D60.6%
F00%

Most frequent findings

Every observation the grader made, ranked by how many domains it applied to. Green is praise, amber is a deduction, red is disqualifying.

Classical algorithm — migration ahead100%991Chain complete as served99.8%989Within validity period92.6%918TLS 1.3 negotiated87%862Legacy TLS refused76.4%757RSA-2048 — fine, but not compact54%535Lifetime of 90 days or less44.8%444Modern key (ECDSA / EdDSA)40.1%397TLS 1.0 accepted22.3%221TLS 1.3 not offered13%129RSA above 2048 bits6%59In the renewal window (< 30 days)4.6%46
Show the numbers as a table
Most frequent grader findings
FindingDomainsShare
Classical algorithm — migration ahead991100%
Chain complete as served98999.8%
Within validity period91892.6%
TLS 1.3 negotiated86287%
Legacy TLS refused75776.4%
RSA-2048 — fine, but not compact53554%
Lifetime of 90 days or less44444.8%
Modern key (ECDSA / EdDSA)39740.1%
TLS 1.0 accepted22122.3%
TLS 1.3 not offered12913%
RSA above 2048 bits596%
In the renewal window (< 30 days)464.6%

Why domains dropped out

Share of the 9 domains that produced no result. One attempt each — the scanner never retries.

No handshake before the timeout100%9
Show the numbers as a table
Reasons domains produced no measurement
ReasonDomainsShare
No handshake before the timeout9100%

Data

The hosts behind these numbers are rows of the issue's per-host CSV whose crux_countries column contains es. Country lists come from the Chrome UX Report by Google (CC BY 4.0); the results are licensed under CC BY 4.0.

The October 2026 issue

Where does your domain sit?

Every number on this page came out of a scan you can run yourself, one domain at a time, for free.

Domain check

Grade your own domain

The same scan, the same grader, your certificate — plus free alerts before it expires.

README badges

Put the grade in your README

A live badge for your project: current grade, TLS version, days until the certificate expires.