{ "license": { "name": "CC-BY-4.0", "title": "Creative Commons Attribution 4.0 International", "path": "https://creativecommons.org/licenses/by/4.0/" }, "citation": "ecdsa.com, \"The State of Signatures on the Web\", 2026-10. https://ecdsa.com/research/2026-10. Data licensed under CC BY 4.0.", "schema": 2, "issue": "2026-10", "run": { "schema": 2, "issue": "2026-10", "execution": "research-scan-nc9km", "startedAt": "2026-10-23T11:12:34.056Z", "finishedAt": "2026-10-23T11:21:28.777Z", "durationSeconds": 535, "runtime": { "node": "v24.22.0", "openssl": "3.5.8", "defaultOfferHybrid": true }, "vantage": { "platform": "cloud-run", "region": "europe-west1" }, "sourceCommit": "af112214ecbd194ff70f19f2440b5e8ddf6cf3ed", "params": { "concurrency": 64, "waveDelayMs": 500, "watchdogMs": 30000, "deadlineMs": 9600000, "handshakeTimeoutMs": 8000, "legacyTimeoutMs": 4000 }, "tasks": 4, "plan": { "sha256": "4af82c9371a672c180a26f0b73d81b4a844f3bc5f1ea0e71a56c1f88971daa63", "hosts": 16924, "exclusions": { "sha256": "bcbf7b0210daffb659a42e2d5033630a7b0e6bd1141d301b8ec8e88da3a97897", "rules": 0, "excluded": { "tranco": 0, "crux-ru": 0, "crux-es": 0, "crux-mx": 0, "crux-br": 0, "crux-de": 0, "crux-fr": 0, "crux-jp": 0, "crux-cn": 0, "crux-tw": 0 } } }, "lists": [ { "id": "tranco", "provider": "tranco", "country": null, "url": "https://tranco-list.eu/list/56Z8N", "version": "56Z8N", "date": "2026-10-22", "retrievedAt": "2026-10-23T11:11:03.949Z", "query": null, "bytes": null, "sha256": "4a5d7e814a1483859120322de177c520b8512c5dc248ab473cd72b03e08187ed", "depth": 10000, "count": 9999 }, { "id": "crux-ru", "provider": "crux", "country": "ru", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_ru.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:07.643Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_ru.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 28759976, "processed": 28759976, "billed": 29360128, "limit": 20000000000 }, "sha256": "e55bc884c5e18c2c0ba074dbcc273b00de258e20d8efa9a12ff7a489f44817ac", "depth": 1000, "count": 990 }, { "id": "crux-es", "provider": "crux", "country": "es", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_es.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:11.557Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_es.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 34153769, "processed": 34153769, "billed": 34603008, "limit": 20000000000 }, "sha256": "5ab660bc0b4a782305ea38b61ed23e65237e9ac768af1925adb374e3e4023cb8", "depth": 1000, "count": 1000 }, { "id": "crux-mx", "provider": "crux", "country": "mx", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_mx.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:14.992Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_mx.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 21961822, "processed": 21961822, "billed": 22020096, "limit": 20000000000 }, "sha256": "bd61d05aa8a7813d65c49a8a89a060f5cda87b8b1f8cec05f6cf12f0b4e1764f", "depth": 1000, "count": 989 }, { "id": "crux-br", "provider": "crux", "country": "br", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_br.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:17.912Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_br.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 56251747, "processed": 56251747, "billed": 56623104, "limit": 20000000000 }, "sha256": "322830a2f92193cd968692cf754384db9f82fb8b03f592c0cec0e253cd255c63", "depth": 1000, "count": 999 }, { "id": "crux-de", "provider": "crux", "country": "de", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_de.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:20.572Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_de.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 52632929, "processed": 52632929, "billed": 53477376, "limit": 20000000000 }, "sha256": "051e179e8f5ee3713bb9a59d634efb72edb769f59eb3ab0d003a7de632dfd1ac", "depth": 1000, "count": 1000 }, { "id": "crux-fr", "provider": "crux", "country": "fr", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_fr.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:24.480Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_fr.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 47122802, "processed": 47122802, "billed": 47185920, "limit": 20000000000 }, "sha256": "0469885879488992462b21440d9e60ff5a93748dd9ba24c7f4ae56d21385a431", "depth": 1000, "count": 998 }, { "id": "crux-jp", "provider": "crux", "country": "jp", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_jp.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:28.209Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_jp.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 61807317, "processed": 61807317, "billed": 61865984, "limit": 20000000000 }, "sha256": "29fd7d1740fcf1a9c619b44406d04f83f90e6b77993929919750388b92ffc6b5", "depth": 1000, "count": 993 }, { "id": "crux-cn", "provider": "crux", "country": "cn", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_cn.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:32.063Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_cn.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 4754769, "processed": 4754769, "billed": 10485760, "limit": 20000000000 }, "sha256": "6843b46abe9311409b9a6e42004c25ec30cfb670deafeef8da1988f0368c75d9", "depth": 1000, "count": 997 }, { "id": "crux-tw", "provider": "crux", "country": "tw", "url": "https://developer.chrome.com/docs/crux/bigquery", "version": "chrome-ux-report.country_tw.202609", "date": "2026-09-01", "retrievedAt": "2026-10-23T11:11:35.618Z", "query": "SELECT origin, MIN(experimental.popularity.rank) AS rank\nFROM `chrome-ux-report.country_tw.202609`\nWHERE experimental.popularity.rank <= 1000 AND STARTS_WITH(origin, 'https://')\nGROUP BY origin\nORDER BY rank, origin", "bytes": { "dryRun": 12388724, "processed": 12388724, "billed": 12582912, "limit": 20000000000 }, "sha256": "9bac2e3d94e68bc4992f4b67e5a6fd4c0cdfb6ab24f3bc661d188f1b458709bc", "depth": 1000, "count": 992 } ], "attempted": 16924, "notAttempted": [] }, "slices": [ { "id": "tranco", "kind": "world", "list": "tranco", "country": null, "maxRank": null, "depth": 10000, "requested": 9999, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 9999, "ok": 7909, "failed": 2090, "okShare": 79.1 }, "errors": [ { "key": "dns-error", "label": "No public DNS answer", "count": 1607, "share": 76.9 }, { "key": "timeout", "label": "No handshake before the timeout", "count": 322, "share": 15.4 }, { "key": "unreachable", "label": "Port 443 refused or reset", "count": 73, "share": 3.5 }, { "key": "tls-error", "label": "Handshake or certificate error", "count": 51, "share": 2.4 }, { "key": "private-address", "label": "Resolves to reserved address space", "count": 37, "share": 1.8 } ], "keyFamilies": [ { "key": "rsa", "label": "RSA", "count": 4669, "share": 59 }, { "key": "ecdsa", "label": "ECDSA", "count": 3240, "share": 41 } ], "keyTypes": [ { "key": "RSA-2048", "label": "RSA-2048", "count": 4318, "share": 54.6 }, { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 3195, "share": 40.4 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 321, "share": 4.1 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 45, "share": 0.6 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 30, "share": 0.4 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 6707, "share": 84.8 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 1202, "share": 15.2 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 5578, "share": 70.5 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 2194, "share": 27.7 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 135, "share": 1.7 }, { "key": "accepted:TLSv1", "label": "Accepted TLS 1.0", "count": 2, "share": 0 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 49, "share": 0.6 }, { "key": "48-100", "label": "48–100 days", "count": 4105, "share": 51.9 }, { "key": "101-200", "label": "101–200 days", "count": 2511, "share": 31.7 }, { "key": "201-398", "label": "201–398 days", "count": 1233, "share": 15.6 }, { "key": ">398", "label": "> 398 days", "count": 11, "share": 0.1 } ], "lifetimeStats": { "min": 30, "median": 90, "mean": 301.1, "max": 999999, "within47": 49, "within47Share": 0.6, "within100": 4154, "within100Share": 52.5, "within200": 6665, "within200Share": 84.3, "over200": 1244, "over200Share": 15.7 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 3774, "share": 47.7 }, { "key": "199", "label": "199 days", "count": 1378, "share": 17.4 }, { "key": "198", "label": "198 days", "count": 962, "share": 12.2 }, { "key": "397", "label": "397 days", "count": 437, "share": 5.5 }, { "key": "84", "label": "84 days", "count": 204, "share": 2.6 }, { "key": "395", "label": "395 days", "count": 195, "share": 2.5 }, { "key": "365", "label": "365 days", "count": 160, "share": 2 }, { "key": "394", "label": "394 days", "count": 117, "share": 1.5 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 3240 }, { "key": "rsa", "label": "RSA", "median": 198, "count": 4669 } ], "grades": [ { "key": "A+", "label": "A+", "count": 1439, "share": 18.2 }, { "key": "A", "label": "A", "count": 3434, "share": 43.4 }, { "key": "B", "label": "B", "count": 768, "share": 9.7 }, { "key": "C", "label": "C", "count": 2186, "share": 27.6 }, { "key": "D", "label": "D", "count": 45, "share": 0.6 }, { "key": "F", "label": "F", "count": 37, "share": 0.5 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 4689, "share": 59.3 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 2092, "share": 26.5 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 1038, "share": 13.1 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 82, "share": 1 }, { "key": "sha512WithRSAEncryption", "label": "sha512WithRSAEncryption", "count": 8, "share": 0.1 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 1813, "share": 22.9 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 578, "share": 7.3 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 505, "share": 6.4 }, { "key": "YR2", "label": "YR2", "count": 479, "share": 6.1 }, { "key": "YR1", "label": "YR1", "count": 472, "share": 6 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 430, "share": 5.4 }, { "key": "YE1", "label": "YE1", "count": 407, "share": 5.1 }, { "key": "YE2", "label": "YE2", "count": 391, "share": 4.9 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 211, "share": 2.7 }, { "key": "WE2", "label": "WE2", "count": 198, "share": 2.5 }, { "key": "Sectigo Public Server Authentication CA OV R36", "label": "Sectigo Public Server Authentication CA OV R36", "count": 183, "share": 2.3 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 175, "share": 2.2 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 132, "share": 1.7 }, { "key": "GlobalSign RSA OV SSL CA 2018", "label": "GlobalSign RSA OV SSL CA 2018", "count": 119, "share": 1.5 }, { "key": "WR3", "label": "WR3", "count": 118, "share": 1.5 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 2169, "share": 27.4, "ecdsa": 2029, "rsa": 140 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 1753, "share": 22.2, "ecdsa": 799, "rsa": 954 }, { "key": "Amazon", "label": "Amazon", "count": 1106, "share": 14, "ecdsa": 20, "rsa": 1086 }, { "key": "DigiCert", "label": "DigiCert", "count": 1074, "share": 13.6, "ecdsa": 240, "rsa": 834 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 559, "share": 7.1, "ecdsa": 51, "rsa": 508 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 528, "share": 6.7, "ecdsa": 65, "rsa": 463 }, { "key": "Sectigo", "label": "Sectigo", "count": 480, "share": 6.1, "ecdsa": 27, "rsa": 453 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 70, "share": 0.9, "ecdsa": 0, "rsa": 70 }, { "key": "Microsoft", "label": "Microsoft", "count": 51, "share": 0.6, "ecdsa": 1, "rsa": 50 }, { "key": "Certum", "label": "Certum", "count": 42, "share": 0.5, "ecdsa": 1, "rsa": 41 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 32, "share": 0.4, "ecdsa": 0, "rsa": 32 }, { "key": "Entrust", "label": "Entrust", "count": 27, "share": 0.3, "ecdsa": 3, "rsa": 24 }, { "key": "Apple", "label": "Apple", "count": 12, "share": 0.2, "ecdsa": 4, "rsa": 8 }, { "key": "Unidentified issuer", "label": "Unidentified issuer", "count": 6, "share": 0.1, "ecdsa": 0, "rsa": 6 } ], "findings": [ { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 7909, "share": 100 }, { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 7872, "share": 99.5 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 7554, "share": 95.5 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 6707, "share": 84.8 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 5578, "share": 70.5 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 4318, "share": 54.6 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 4045, "share": 51.1 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 3240, "share": 41 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 2196, "share": 27.8 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 1202, "share": 15.2 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 351, "share": 4.4 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 239, "share": 3 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 144, "share": 1.8 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 135, "share": 1.7 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 86, "share": 1.1 }, { "key": "cert-expired", "label": "Certificate expired", "title": "Certificate expired", "severity": "critical", "count": 30, "share": 0.4 }, { "key": "chain-incomplete", "label": "Chain incomplete as served", "title": "Chain incomplete as served", "severity": "warn", "count": 29, "share": 0.4 }, { "key": "cert-lifetime-over-cab", "label": "Lifetime over the CA/Browser Forum limit", "title": "Lifetime over the CA/Browser Forum limit", "severity": "warn", "count": 13, "share": 0.2 }, { "key": "leaf-self-signed", "label": "Self-signed leaf certificate", "title": "Self-signed leaf certificate", "severity": "warn", "count": 8, "share": 0.1 } ], "flags": { "sha1AnywhereInChain": 144, "sha1AnywhereShare": 1.8, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 7880, "chainCompleteShare": 99.6, "tls13": 6707, "tls13Share": 84.8, "legacyAccepted": 2331, "legacyAcceptedShare": 29.5, "rsaBelow2048": 0, "expired": 30 } }, "pq": { "measured": 7870, "unreported": 39, "hybrid": 4620, "hybridShare": 58.7, "postQuantum": 4620, "postQuantumShare": 58.7, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 4620, "share": 58.7 }, { "key": "x25519", "label": "x25519", "count": 2423, "share": 30.8 }, { "key": "secp256r1", "label": "secp256r1", "count": 703, "share": 8.9 }, { "key": "secp384r1", "label": "secp384r1", "count": 83, "share": 1.1 }, { "key": "secp521r1", "label": "secp521r1", "count": 41, "share": 0.5 } ], "tls13": 6707, "postQuantumOfTls13Share": 68.9 } }, { "id": "tranco-top500", "kind": "worldTop500", "list": "tranco", "country": null, "maxRank": 500, "depth": 500, "requested": 500, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 500, "ok": 349, "failed": 151, "okShare": 69.8 }, "errors": [ { "key": "dns-error", "label": "No public DNS answer", "count": 122, "share": 80.8 }, { "key": "timeout", "label": "No handshake before the timeout", "count": 20, "share": 13.2 }, { "key": "private-address", "label": "Resolves to reserved address space", "count": 4, "share": 2.6 }, { "key": "tls-error", "label": "Handshake or certificate error", "count": 3, "share": 2 }, { "key": "unreachable", "label": "Port 443 refused or reset", "count": 2, "share": 1.3 } ], "keyFamilies": [ { "key": "rsa", "label": "RSA", "count": 207, "share": 59.3 }, { "key": "ecdsa", "label": "ECDSA", "count": 142, "share": 40.7 } ], "keyTypes": [ { "key": "RSA-2048", "label": "RSA-2048", "count": 204, "share": 58.5 }, { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 139, "share": 39.8 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 3, "share": 0.9 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 3, "share": 0.9 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 297, "share": 85.1 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 52, "share": 14.9 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 260, "share": 74.5 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 83, "share": 23.8 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 6, "share": 1.7 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 4, "share": 1.1 }, { "key": "48-100", "label": "48–100 days", "count": 165, "share": 47.3 }, { "key": "101-200", "label": "101–200 days", "count": 128, "share": 36.7 }, { "key": "201-398", "label": "201–398 days", "count": 52, "share": 14.9 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 30, "median": 181, "mean": 172.4, "max": 397, "within47": 4, "within47Share": 1.1, "within100": 169, "within100Share": 48.4, "within200": 297, "within200Share": 85.1, "over200": 52, "over200Share": 14.9 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 112, "share": 32.1 }, { "key": "199", "label": "199 days", "count": 74, "share": 21.2 }, { "key": "198", "label": "198 days", "count": 45, "share": 12.9 }, { "key": "84", "label": "84 days", "count": 30, "share": 8.6 }, { "key": "397", "label": "397 days", "count": 21, "share": 6 }, { "key": "100", "label": "100 days", "count": 12, "share": 3.4 }, { "key": "91", "label": "91 days", "count": 8, "share": 2.3 }, { "key": "395", "label": "395 days", "count": 7, "share": 2 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 142 }, { "key": "rsa", "label": "RSA", "median": 198, "count": 207 } ], "grades": [ { "key": "A+", "label": "A+", "count": 71, "share": 20.3 }, { "key": "A", "label": "A", "count": 154, "share": 44.1 }, { "key": "B", "label": "B", "count": 39, "share": 11.2 }, { "key": "C", "label": "C", "count": 77, "share": 22.1 }, { "key": "D", "label": "D", "count": 8, "share": 2.3 }, { "key": "F", "label": "F", "count": 0, "share": 0 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 210, "share": 60.2 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 76, "share": 21.8 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 49, "share": 14 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 14, "share": 4 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 41, "share": 11.7 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 35, "share": 10 }, { "key": "WE2", "label": "WE2", "count": 27, "share": 7.7 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 23, "share": 6.6 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 19, "share": 5.4 }, { "key": "YE2", "label": "YE2", "count": 19, "share": 5.4 }, { "key": "YE1", "label": "YE1", "count": 15, "share": 4.3 }, { "key": "YR1", "label": "YR1", "count": 15, "share": 4.3 }, { "key": "YR2", "label": "YR2", "count": 12, "share": 3.4 }, { "key": "Sectigo Public Server Authentication CA OV R36", "label": "Sectigo Public Server Authentication CA OV R36", "count": 11, "share": 3.2 }, { "key": "GlobalSign GCC R46 OV TLS CA 2025", "label": "GlobalSign GCC R46 OV TLS CA 2025", "count": 9, "share": 2.6 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 7, "share": 2 }, { "key": "Microsoft TLS G2 RSA CA OCSP 02", "label": "Microsoft TLS G2 RSA CA OCSP 02", "count": 7, "share": 2 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 5, "share": 1.4 }, { "key": "GlobalSign RSA OV SSL CA 2018", "label": "GlobalSign RSA OV SSL CA 2018", "count": 5, "share": 1.4 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 77, "share": 22.1, "ecdsa": 69, "rsa": 8 }, { "key": "DigiCert", "label": "DigiCert", "count": 63, "share": 18.1, "ecdsa": 19, "rsa": 44 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 61, "share": 17.5, "ecdsa": 34, "rsa": 27 }, { "key": "Amazon", "label": "Amazon", "count": 43, "share": 12.3, "ecdsa": 0, "rsa": 43 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 36, "share": 10.3, "ecdsa": 11, "rsa": 25 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 26, "share": 7.4, "ecdsa": 5, "rsa": 21 }, { "key": "Sectigo", "label": "Sectigo", "count": 21, "share": 6, "ecdsa": 2, "rsa": 19 }, { "key": "Microsoft", "label": "Microsoft", "count": 14, "share": 4, "ecdsa": 0, "rsa": 14 }, { "key": "Apple", "label": "Apple", "count": 3, "share": 0.9, "ecdsa": 2, "rsa": 1 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 3, "share": 0.9, "ecdsa": 0, "rsa": 3 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 2, "share": 0.6, "ecdsa": 0, "rsa": 2 } ], "findings": [ { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 349, "share": 100 }, { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 349, "share": 100 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 330, "share": 94.6 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 297, "share": 85.1 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 260, "share": 74.5 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 204, "share": 58.5 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 149, "share": 42.7 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 142, "share": 40.7 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 83, "share": 23.8 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 52, "share": 14.9 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 10, "share": 2.9 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 9, "share": 2.6 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 7, "share": 2 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 6, "share": 1.7 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 3, "share": 0.9 }, { "key": "cert-lifetime-over-cab", "label": "Lifetime over the CA/Browser Forum limit", "title": "Lifetime over the CA/Browser Forum limit", "severity": "warn", "count": 1, "share": 0.3 } ], "flags": { "sha1AnywhereInChain": 7, "sha1AnywhereShare": 2, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 349, "chainCompleteShare": 100, "tls13": 297, "tls13Share": 85.1, "legacyAccepted": 89, "legacyAcceptedShare": 25.5, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 344, "unreported": 5, "hybrid": 197, "hybridShare": 57.3, "postQuantum": 197, "postQuantumShare": 57.3, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 197, "share": 57.3 }, { "key": "x25519", "label": "x25519", "count": 116, "share": 33.7 }, { "key": "secp256r1", "label": "secp256r1", "count": 23, "share": 6.7 }, { "key": "secp521r1", "label": "secp521r1", "count": 6, "share": 1.7 }, { "key": "secp384r1", "label": "secp384r1", "count": 2, "share": 0.6 } ], "tls13": 297, "postQuantumOfTls13Share": 66.3 } }, { "id": "crux-ru", "kind": "country", "list": "crux-ru", "country": "ru", "maxRank": null, "depth": 1000, "requested": 990, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 990, "ok": 955, "failed": 35, "okShare": 96.5 }, "errors": [ { "key": "timeout", "label": "No handshake before the timeout", "count": 30, "share": 85.7 }, { "key": "dns-error", "label": "No public DNS answer", "count": 3, "share": 8.6 }, { "key": "unreachable", "label": "Port 443 refused or reset", "count": 2, "share": 5.7 } ], "keyFamilies": [ { "key": "rsa", "label": "RSA", "count": 670, "share": 70.2 }, { "key": "ecdsa", "label": "ECDSA", "count": 285, "share": 29.8 } ], "keyTypes": [ { "key": "RSA-2048", "label": "RSA-2048", "count": 558, "share": 58.4 }, { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 278, "share": 29.1 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 109, "share": 11.4 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 7, "share": 0.7 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 3, "share": 0.3 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 757, "share": 79.3 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 198, "share": 20.7 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 569, "share": 59.6 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 361, "share": 37.8 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 25, "share": 2.6 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 1, "share": 0.1 }, { "key": "48-100", "label": "48–100 days", "count": 609, "share": 63.8 }, { "key": "101-200", "label": "101–200 days", "count": 211, "share": 22.1 }, { "key": "201-398", "label": "201–398 days", "count": 134, "share": 14 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 45, "median": 90, "mean": 156, "max": 397, "within47": 1, "within47Share": 0.1, "within100": 610, "within100Share": 63.9, "within200": 821, "within200Share": 86, "over200": 134, "over200Share": 14 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 589, "share": 61.7 }, { "key": "199", "label": "199 days", "count": 158, "share": 16.5 }, { "key": "397", "label": "397 days", "count": 117, "share": 12.3 }, { "key": "181", "label": "181 days", "count": 23, "share": 2.4 }, { "key": "198", "label": "198 days", "count": 14, "share": 1.5 }, { "key": "84", "label": "84 days", "count": 14, "share": 1.5 }, { "key": "182", "label": "182 days", "count": 9, "share": 0.9 }, { "key": "365", "label": "365 days", "count": 7, "share": 0.7 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 285 }, { "key": "rsa", "label": "RSA", "median": 90, "count": 670 } ], "grades": [ { "key": "A+", "label": "A+", "count": 125, "share": 13.1 }, { "key": "A", "label": "A", "count": 376, "share": 39.4 }, { "key": "B", "label": "B", "count": 89, "share": 9.3 }, { "key": "C", "label": "C", "count": 351, "share": 36.8 }, { "key": "D", "label": "D", "count": 12, "share": 1.3 }, { "key": "F", "label": "F", "count": 2, "share": 0.2 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 676, "share": 70.8 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 172, "share": 18 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 103, "share": 10.8 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 4, "share": 0.4 } ], "issuers": [ { "key": "YR2", "label": "YR2", "count": 185, "share": 19.4 }, { "key": "YR1", "label": "YR1", "count": 155, "share": 16.2 }, { "key": "WE1", "label": "WE1", "count": 85, "share": 8.9 }, { "key": "YE1", "label": "YE1", "count": 85, "share": 8.9 }, { "key": "GlobalSign GCC R3 DV TLS CA 2020", "label": "GlobalSign GCC R3 DV TLS CA 2020", "count": 72, "share": 7.5 }, { "key": "YE2", "label": "YE2", "count": 72, "share": 7.5 }, { "key": "GlobalSign RSA OV SSL CA 2018", "label": "GlobalSign RSA OV SSL CA 2018", "count": 44, "share": 4.6 }, { "key": "GlobalSign GCC R46 OV TLS CA 2025", "label": "GlobalSign GCC R46 OV TLS CA 2025", "count": 40, "share": 4.2 }, { "key": "GlobalSign GCC R6 AlphaSSL CA 2025", "label": "GlobalSign GCC R6 AlphaSSL CA 2025", "count": 37, "share": 3.9 }, { "key": "GlobalSign GCC R46 AlphaSSL CA 2025", "label": "GlobalSign GCC R46 AlphaSSL CA 2025", "count": 30, "share": 3.1 }, { "key": "HARICA DV TLS RSA", "label": "HARICA DV TLS RSA", "count": 30, "share": 3.1 }, { "key": "GlobalSign GCC R46 DV TLS CA 2025", "label": "GlobalSign GCC R46 DV TLS CA 2025", "count": 25, "share": 2.6 }, { "key": "WE2", "label": "WE2", "count": 14, "share": 1.5 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 11, "share": 1.2 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 8, "share": 0.8 } ], "caGroups": [ { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 497, "share": 52, "ecdsa": 157, "rsa": 340 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 261, "share": 27.3, "ecdsa": 12, "rsa": 249 }, { "key": "Google Trust Services", "label": "Google Trust Services", "count": 99, "share": 10.4, "ecdsa": 99, "rsa": 0 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 56, "share": 5.9, "ecdsa": 6, "rsa": 50 }, { "key": "DigiCert", "label": "DigiCert", "count": 16, "share": 1.7, "ecdsa": 8, "rsa": 8 }, { "key": "Sectigo", "label": "Sectigo", "count": 15, "share": 1.6, "ecdsa": 2, "rsa": 13 }, { "key": "Amazon", "label": "Amazon", "count": 7, "share": 0.7, "ecdsa": 0, "rsa": 7 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 2, "share": 0.2, "ecdsa": 0, "rsa": 2 }, { "key": "Apple", "label": "Apple", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 }, { "key": "Microsoft", "label": "Microsoft", "count": 1, "share": 0.1, "ecdsa": 1, "rsa": 0 } ], "findings": [ { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 955, "share": 100 }, { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 952, "share": 99.7 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 871, "share": 91.2 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 757, "share": 79.3 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 604, "share": 63.2 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 569, "share": 59.6 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 558, "share": 58.4 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 361, "share": 37.8 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 285, "share": 29.8 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 198, "share": 20.7 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 112, "share": 11.7 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 60, "share": 6.3 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 25, "share": 2.6 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 23, "share": 2.4 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 15, "share": 1.6 }, { "key": "cert-lifetime-over-cab", "label": "Lifetime over the CA/Browser Forum limit", "title": "Lifetime over the CA/Browser Forum limit", "severity": "warn", "count": 3, "share": 0.3 }, { "key": "chain-incomplete", "label": "Chain incomplete as served", "title": "Chain incomplete as served", "severity": "warn", "count": 2, "share": 0.2 }, { "key": "cert-expired", "label": "Certificate expired", "title": "Certificate expired", "severity": "critical", "count": 1, "share": 0.1 }, { "key": "leaf-self-signed", "label": "Self-signed leaf certificate", "title": "Self-signed leaf certificate", "severity": "warn", "count": 1, "share": 0.1 } ], "flags": { "sha1AnywhereInChain": 15, "sha1AnywhereShare": 1.6, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 953, "chainCompleteShare": 99.8, "tls13": 757, "tls13Share": 79.3, "legacyAccepted": 386, "legacyAcceptedShare": 40.4, "rsaBelow2048": 0, "expired": 1 } }, "pq": { "measured": 955, "unreported": 0, "hybrid": 258, "hybridShare": 27, "postQuantum": 258, "postQuantumShare": 27, "groups": [ { "key": "x25519", "label": "x25519", "count": 643, "share": 67.3 }, { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 258, "share": 27 }, { "key": "secp256r1", "label": "secp256r1", "count": 43, "share": 4.5 }, { "key": "secp384r1", "label": "secp384r1", "count": 9, "share": 0.9 }, { "key": "secp521r1", "label": "secp521r1", "count": 2, "share": 0.2 } ], "tls13": 757, "postQuantumOfTls13Share": 34.1 } }, { "id": "crux-es", "kind": "country", "list": "crux-es", "country": "es", "maxRank": null, "depth": 1000, "requested": 1000, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 1000, "ok": 991, "failed": 9, "okShare": 99.1 }, "errors": [ { "key": "timeout", "label": "No handshake before the timeout", "count": 9, "share": 100 } ], "keyFamilies": [ { "key": "rsa", "label": "RSA", "count": 594, "share": 59.9 }, { "key": "ecdsa", "label": "ECDSA", "count": 397, "share": 40.1 } ], "keyTypes": [ { "key": "RSA-2048", "label": "RSA-2048", "count": 535, "share": 54 }, { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 392, "share": 39.6 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 34, "share": 3.4 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 25, "share": 2.5 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 5, "share": 0.5 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 862, "share": 87 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 129, "share": 13 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 757, "share": 76.4 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 221, "share": 22.3 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 13, "share": 1.3 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 26, "share": 2.6 }, { "key": "48-100", "label": "48–100 days", "count": 428, "share": 43.2 }, { "key": "101-200", "label": "101–200 days", "count": 354, "share": 35.7 }, { "key": "201-398", "label": "201–398 days", "count": 183, "share": 18.5 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 14, "median": 198, "mean": 180.3, "max": 397, "within47": 26, "within47Share": 2.6, "within100": 454, "within100Share": 45.8, "within200": 808, "within200Share": 81.5, "over200": 183, "over200Share": 18.5 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 387, "share": 39.1 }, { "key": "199", "label": "199 days", "count": 232, "share": 23.4 }, { "key": "198", "label": "198 days", "count": 93, "share": 9.4 }, { "key": "397", "label": "397 days", "count": 56, "share": 5.7 }, { "key": "365", "label": "365 days", "count": 35, "share": 3.5 }, { "key": "84", "label": "84 days", "count": 29, "share": 2.9 }, { "key": "30", "label": "30 days", "count": 25, "share": 2.5 }, { "key": "395", "label": "395 days", "count": 24, "share": 2.4 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 397 }, { "key": "rsa", "label": "RSA", "median": 199, "count": 594 } ], "grades": [ { "key": "A+", "label": "A+", "count": 147, "share": 14.8 }, { "key": "A", "label": "A", "count": 508, "share": 51.3 }, { "key": "B", "label": "B", "count": 114, "share": 11.5 }, { "key": "C", "label": "C", "count": 216, "share": 21.8 }, { "key": "D", "label": "D", "count": 6, "share": 0.6 }, { "key": "F", "label": "F", "count": 0, "share": 0 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 593, "share": 59.8 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 226, "share": 22.8 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 160, "share": 16.1 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 12, "share": 1.2 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 184, "share": 18.6 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 61, "share": 6.2 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 56, "share": 5.7 }, { "key": "YR2", "label": "YR2", "count": 56, "share": 5.7 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 47, "share": 4.7 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 46, "share": 4.6 }, { "key": "YE2", "label": "YE2", "count": 45, "share": 4.5 }, { "key": "YE1", "label": "YE1", "count": 43, "share": 4.3 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 42, "share": 4.2 }, { "key": "YR1", "label": "YR1", "count": 42, "share": 4.2 }, { "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3", "label": "GlobalSign Atlas R46 DV TLS CA 2026 Q3", "count": 40, "share": 4 }, { "key": "WE2", "label": "WE2", "count": 29, "share": 2.9 }, { "key": "Certainly Intermediate R1", "label": "Certainly Intermediate R1", "count": 25, "share": 2.5 }, { "key": "GlobalSign RSA OV SSL CA 2018", "label": "GlobalSign RSA OV SSL CA 2018", "count": 25, "share": 2.5 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 24, "share": 2.4 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 224, "share": 22.6, "ecdsa": 214, "rsa": 10 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 186, "share": 18.8, "ecdsa": 88, "rsa": 98 }, { "key": "DigiCert", "label": "DigiCert", "count": 168, "share": 17, "ecdsa": 74, "rsa": 94 }, { "key": "Amazon", "label": "Amazon", "count": 105, "share": 10.6, "ecdsa": 2, "rsa": 103 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 86, "share": 8.7, "ecdsa": 2, "rsa": 84 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 83, "share": 8.4, "ecdsa": 9, "rsa": 74 }, { "key": "Sectigo", "label": "Sectigo", "count": 80, "share": 8.1, "ecdsa": 6, "rsa": 74 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 25, "share": 2.5, "ecdsa": 0, "rsa": 25 }, { "key": "Unidentified issuer", "label": "Unidentified issuer", "count": 19, "share": 1.9, "ecdsa": 0, "rsa": 19 }, { "key": "Microsoft", "label": "Microsoft", "count": 6, "share": 0.6, "ecdsa": 2, "rsa": 4 }, { "key": "Entrust", "label": "Entrust", "count": 4, "share": 0.4, "ecdsa": 0, "rsa": 4 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 4, "share": 0.4, "ecdsa": 0, "rsa": 4 }, { "key": "Apple", "label": "Apple", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 } ], "findings": [ { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 991, "share": 100 }, { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 989, "share": 99.8 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 918, "share": 92.6 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 862, "share": 87 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 757, "share": 76.4 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 535, "share": 54 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 444, "share": 44.8 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 397, "share": 40.1 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 221, "share": 22.3 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 129, "share": 13 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 59, "share": 6 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 46, "share": 4.6 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 27, "share": 2.7 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 19, "share": 1.9 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 13, "share": 1.3 }, { "key": "chain-incomplete", "label": "Chain incomplete as served", "title": "Chain incomplete as served", "severity": "warn", "count": 2, "share": 0.2 } ], "flags": { "sha1AnywhereInChain": 19, "sha1AnywhereShare": 1.9, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 989, "chainCompleteShare": 99.8, "tls13": 862, "tls13Share": 87, "legacyAccepted": 234, "legacyAcceptedShare": 23.6, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 989, "unreported": 2, "hybrid": 676, "hybridShare": 68.4, "postQuantum": 676, "postQuantumShare": 68.4, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 676, "share": 68.4 }, { "key": "x25519", "label": "x25519", "count": 246, "share": 24.9 }, { "key": "secp256r1", "label": "secp256r1", "count": 55, "share": 5.6 }, { "key": "secp384r1", "label": "secp384r1", "count": 11, "share": 1.1 }, { "key": "secp521r1", "label": "secp521r1", "count": 1, "share": 0.1 } ], "tls13": 862, "postQuantumOfTls13Share": 78.4 } }, { "id": "crux-mx", "kind": "country", "list": "crux-mx", "country": "mx", "maxRank": null, "depth": 1000, "requested": 989, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 989, "ok": 942, "failed": 47, "okShare": 95.2 }, "errors": [ { "key": "timeout", "label": "No handshake before the timeout", "count": 26, "share": 55.3 }, { "key": "tls-error", "label": "Handshake or certificate error", "count": 9, "share": 19.1 }, { "key": "dns-error", "label": "No public DNS answer", "count": 8, "share": 17 }, { "key": "unreachable", "label": "Port 443 refused or reset", "count": 3, "share": 6.4 }, { "key": "private-address", "label": "Resolves to reserved address space", "count": 1, "share": 2.1 } ], "keyFamilies": [ { "key": "ecdsa", "label": "ECDSA", "count": 474, "share": 50.3 }, { "key": "rsa", "label": "RSA", "count": 468, "share": 49.7 } ], "keyTypes": [ { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 472, "share": 50.1 }, { "key": "RSA-2048", "label": "RSA-2048", "count": 459, "share": 48.7 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 7, "share": 0.7 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 2, "share": 0.2 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 2, "share": 0.2 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 871, "share": 92.5 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 71, "share": 7.5 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 632, "share": 67.1 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 296, "share": 31.4 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 14, "share": 1.5 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 8, "share": 0.8 }, { "key": "48-100", "label": "48–100 days", "count": 512, "share": 54.4 }, { "key": "101-200", "label": "101–200 days", "count": 284, "share": 30.1 }, { "key": "201-398", "label": "201–398 days", "count": 138, "share": 14.6 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 30, "median": 90, "mean": 163.9, "max": 397, "within47": 8, "within47Share": 0.8, "within100": 520, "within100Share": 55.2, "within200": 804, "within200Share": 85.4, "over200": 138, "over200Share": 14.6 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 454, "share": 48.2 }, { "key": "199", "label": "199 days", "count": 164, "share": 17.4 }, { "key": "198", "label": "198 days", "count": 95, "share": 10.1 }, { "key": "84", "label": "84 days", "count": 37, "share": 3.9 }, { "key": "397", "label": "397 days", "count": 36, "share": 3.8 }, { "key": "365", "label": "365 days", "count": 25, "share": 2.7 }, { "key": "366", "label": "366 days", "count": 20, "share": 2.1 }, { "key": "395", "label": "395 days", "count": 12, "share": 1.3 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 474 }, { "key": "rsa", "label": "RSA", "median": 199, "count": 468 } ], "grades": [ { "key": "A+", "label": "A+", "count": 166, "share": 17.6 }, { "key": "A", "label": "A", "count": 407, "share": 43.2 }, { "key": "B", "label": "B", "count": 66, "share": 7 }, { "key": "C", "label": "C", "count": 295, "share": 31.3 }, { "key": "D", "label": "D", "count": 8, "share": 0.8 }, { "key": "F", "label": "F", "count": 0, "share": 0 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 473, "share": 50.2 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 313, "share": 33.2 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 145, "share": 15.4 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 11, "share": 1.2 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 267, "share": 28.3 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 99, "share": 10.5 }, { "key": "YE1", "label": "YE1", "count": 54, "share": 5.7 }, { "key": "YR2", "label": "YR2", "count": 44, "share": 4.7 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 43, "share": 4.6 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 42, "share": 4.5 }, { "key": "YE2", "label": "YE2", "count": 42, "share": 4.5 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 40, "share": 4.2 }, { "key": "YR1", "label": "YR1", "count": 38, "share": 4 }, { "key": "WE2", "label": "WE2", "count": 37, "share": 3.9 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 32, "share": 3.4 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 29, "share": 3.1 }, { "key": "Go Daddy Secure Certificate Authority - G2", "label": "Go Daddy Secure Certificate Authority - G2", "count": 18, "share": 1.9 }, { "key": "Sectigo Public Server Authentication CA OV R36", "label": "Sectigo Public Server Authentication CA OV R36", "count": 17, "share": 1.8 }, { "key": "GlobalSign GCC R46 OV TLS CA 2025", "label": "GlobalSign GCC R46 OV TLS CA 2025", "count": 14, "share": 1.5 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 308, "share": 32.7, "ecdsa": 304, "rsa": 4 }, { "key": "DigiCert", "label": "DigiCert", "count": 202, "share": 21.4, "ecdsa": 60, "rsa": 142 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 178, "share": 18.9, "ecdsa": 96, "rsa": 82 }, { "key": "Amazon", "label": "Amazon", "count": 89, "share": 9.4, "ecdsa": 4, "rsa": 85 }, { "key": "Sectigo", "label": "Sectigo", "count": 51, "share": 5.4, "ecdsa": 1, "rsa": 50 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 41, "share": 4.4, "ecdsa": 2, "rsa": 39 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 33, "share": 3.5, "ecdsa": 1, "rsa": 32 }, { "key": "Microsoft", "label": "Microsoft", "count": 14, "share": 1.5, "ecdsa": 6, "rsa": 8 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 9, "share": 1, "ecdsa": 0, "rsa": 9 }, { "key": "Apple", "label": "Apple", "count": 6, "share": 0.6, "ecdsa": 0, "rsa": 6 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 6, "share": 0.6, "ecdsa": 0, "rsa": 6 }, { "key": "Entrust", "label": "Entrust", "count": 5, "share": 0.5, "ecdsa": 0, "rsa": 5 } ], "findings": [ { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 942, "share": 100 }, { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 933, "share": 99 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 876, "share": 93 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 871, "share": 92.5 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 632, "share": 67.1 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 505, "share": 53.6 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 474, "share": 50.3 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 459, "share": 48.7 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 296, "share": 31.4 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 71, "share": 7.5 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 47, "share": 5 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 19, "share": 2 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 14, "share": 1.5 }, { "key": "chain-incomplete", "label": "Chain incomplete as served", "title": "Chain incomplete as served", "severity": "warn", "count": 9, "share": 1 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 9, "share": 1 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 5, "share": 0.5 } ], "flags": { "sha1AnywhereInChain": 5, "sha1AnywhereShare": 0.5, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 933, "chainCompleteShare": 99, "tls13": 871, "tls13Share": 92.5, "legacyAccepted": 310, "legacyAcceptedShare": 32.9, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 941, "unreported": 1, "hybrid": 725, "hybridShare": 77, "postQuantum": 725, "postQuantumShare": 77, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 725, "share": 77 }, { "key": "x25519", "label": "x25519", "count": 170, "share": 18.1 }, { "key": "secp256r1", "label": "secp256r1", "count": 31, "share": 3.3 }, { "key": "secp384r1", "label": "secp384r1", "count": 9, "share": 1 }, { "key": "secp521r1", "label": "secp521r1", "count": 6, "share": 0.6 } ], "tls13": 871, "postQuantumOfTls13Share": 83.2 } }, { "id": "crux-br", "kind": "country", "list": "crux-br", "country": "br", "maxRank": null, "depth": 1000, "requested": 999, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 999, "ok": 971, "failed": 28, "okShare": 97.2 }, "errors": [ { "key": "timeout", "label": "No handshake before the timeout", "count": 19, "share": 67.9 }, { "key": "dns-error", "label": "No public DNS answer", "count": 5, "share": 17.9 }, { "key": "private-address", "label": "Resolves to reserved address space", "count": 2, "share": 7.1 }, { "key": "tls-error", "label": "Handshake or certificate error", "count": 1, "share": 3.6 }, { "key": "unreachable", "label": "Port 443 refused or reset", "count": 1, "share": 3.6 } ], "keyFamilies": [ { "key": "ecdsa", "label": "ECDSA", "count": 514, "share": 52.9 }, { "key": "rsa", "label": "RSA", "count": 457, "share": 47.1 } ], "keyTypes": [ { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 512, "share": 52.7 }, { "key": "RSA-2048", "label": "RSA-2048", "count": 421, "share": 43.4 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 34, "share": 3.5 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 2, "share": 0.2 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 2, "share": 0.2 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 878, "share": 90.4 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 93, "share": 9.6 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 596, "share": 61.4 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 345, "share": 35.5 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 29, "share": 3 }, { "key": "accepted:TLSv1", "label": "Accepted TLS 1.0", "count": 1, "share": 0.1 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 5, "share": 0.5 }, { "key": "48-100", "label": "48–100 days", "count": 599, "share": 61.7 }, { "key": "101-200", "label": "101–200 days", "count": 264, "share": 27.2 }, { "key": "201-398", "label": "201–398 days", "count": 103, "share": 10.6 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 14, "median": 90, "mean": 149.4, "max": 397, "within47": 5, "within47Share": 0.5, "within100": 604, "within100Share": 62.2, "within200": 868, "within200Share": 89.4, "over200": 103, "over200Share": 10.6 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 543, "share": 55.9 }, { "key": "199", "label": "199 days", "count": 146, "share": 15 }, { "key": "198", "label": "198 days", "count": 91, "share": 9.4 }, { "key": "84", "label": "84 days", "count": 38, "share": 3.9 }, { "key": "397", "label": "397 days", "count": 31, "share": 3.2 }, { "key": "366", "label": "366 days", "count": 20, "share": 2.1 }, { "key": "395", "label": "395 days", "count": 11, "share": 1.1 }, { "key": "91", "label": "91 days", "count": 10, "share": 1 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 514 }, { "key": "rsa", "label": "RSA", "median": 198, "count": 457 } ], "grades": [ { "key": "A+", "label": "A+", "count": 173, "share": 17.8 }, { "key": "A", "label": "A", "count": 376, "share": 38.7 }, { "key": "B", "label": "B", "count": 67, "share": 6.9 }, { "key": "C", "label": "C", "count": 345, "share": 35.5 }, { "key": "D", "label": "D", "count": 8, "share": 0.8 }, { "key": "F", "label": "F", "count": 2, "share": 0.2 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 466, "share": 48 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 358, "share": 36.9 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 142, "share": 14.6 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 5, "share": 0.5 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 313, "share": 32.2 }, { "key": "YR1", "label": "YR1", "count": 67, "share": 6.9 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 62, "share": 6.4 }, { "key": "YR2", "label": "YR2", "count": 57, "share": 5.9 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 50, "share": 5.1 }, { "key": "YE2", "label": "YE2", "count": 48, "share": 4.9 }, { "key": "YE1", "label": "YE1", "count": 39, "share": 4 }, { "key": "WE2", "label": "WE2", "count": 38, "share": 3.9 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 33, "share": 3.4 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 30, "share": 3.1 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 24, "share": 2.5 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 21, "share": 2.2 }, { "key": "Sectigo Public Server Authentication CA OV R36", "label": "Sectigo Public Server Authentication CA OV R36", "count": 19, "share": 2 }, { "key": "Go Daddy Secure Certificate Authority - G2", "label": "Go Daddy Secure Certificate Authority - G2", "count": 12, "share": 1.2 }, { "key": "RapidSSL TLS RSA CA G1", "label": "RapidSSL TLS RSA CA G1", "count": 12, "share": 1.2 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 361, "share": 37.2, "ecdsa": 352, "rsa": 9 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 211, "share": 21.7, "ecdsa": 87, "rsa": 124 }, { "key": "DigiCert", "label": "DigiCert", "count": 138, "share": 14.2, "ecdsa": 65, "rsa": 73 }, { "key": "Amazon", "label": "Amazon", "count": 93, "share": 9.6, "ecdsa": 1, "rsa": 92 }, { "key": "Sectigo", "label": "Sectigo", "count": 55, "share": 5.7, "ecdsa": 2, "rsa": 53 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 51, "share": 5.3, "ecdsa": 2, "rsa": 49 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 37, "share": 3.8, "ecdsa": 0, "rsa": 37 }, { "key": "Microsoft", "label": "Microsoft", "count": 10, "share": 1, "ecdsa": 5, "rsa": 5 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 9, "share": 0.9, "ecdsa": 0, "rsa": 9 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 4, "share": 0.4, "ecdsa": 0, "rsa": 4 }, { "key": "Apple", "label": "Apple", "count": 2, "share": 0.2, "ecdsa": 0, "rsa": 2 } ], "findings": [ { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 971, "share": 100 }, { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 966, "share": 99.5 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 915, "share": 94.2 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 878, "share": 90.4 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 596, "share": 61.4 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 589, "share": 60.7 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 514, "share": 52.9 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 421, "share": 43.4 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 346, "share": 35.6 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 93, "share": 9.6 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 37, "share": 3.8 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 36, "share": 3.7 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 29, "share": 3 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 19, "share": 2 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 7, "share": 0.7 }, { "key": "chain-incomplete", "label": "Chain incomplete as served", "title": "Chain incomplete as served", "severity": "warn", "count": 5, "share": 0.5 } ], "flags": { "sha1AnywhereInChain": 7, "sha1AnywhereShare": 0.7, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 966, "chainCompleteShare": 99.5, "tls13": 878, "tls13Share": 90.4, "legacyAccepted": 375, "legacyAcceptedShare": 38.6, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 967, "unreported": 4, "hybrid": 712, "hybridShare": 73.6, "postQuantum": 712, "postQuantumShare": 73.6, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 712, "share": 73.6 }, { "key": "x25519", "label": "x25519", "count": 197, "share": 20.4 }, { "key": "secp256r1", "label": "secp256r1", "count": 38, "share": 3.9 }, { "key": "secp384r1", "label": "secp384r1", "count": 16, "share": 1.7 }, { "key": "secp521r1", "label": "secp521r1", "count": 4, "share": 0.4 } ], "tls13": 878, "postQuantumOfTls13Share": 81.1 } }, { "id": "crux-de", "kind": "country", "list": "crux-de", "country": "de", "maxRank": null, "depth": 1000, "requested": 1000, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 1000, "ok": 999, "failed": 1, "okShare": 99.9 }, "errors": [ { "key": "timeout", "label": "No handshake before the timeout", "count": 1, "share": 100 } ], "keyFamilies": [ { "key": "ecdsa", "label": "ECDSA", "count": 517, "share": 51.8 }, { "key": "rsa", "label": "RSA", "count": 482, "share": 48.2 } ], "keyTypes": [ { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 504, "share": 50.5 }, { "key": "RSA-2048", "label": "RSA-2048", "count": 418, "share": 41.8 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 53, "share": 5.3 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 13, "share": 1.3 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 11, "share": 1.1 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 947, "share": 94.8 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 52, "share": 5.2 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 751, "share": 75.2 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 246, "share": 24.6 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 2, "share": 0.2 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 7, "share": 0.7 }, { "key": "48-100", "label": "48–100 days", "count": 592, "share": 59.3 }, { "key": "101-200", "label": "101–200 days", "count": 283, "share": 28.3 }, { "key": "201-398", "label": "201–398 days", "count": 117, "share": 11.7 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 23, "median": 90, "mean": 154.2, "max": 397, "within47": 7, "within47Share": 0.7, "within100": 599, "within100Share": 60, "within200": 882, "within200Share": 88.3, "over200": 117, "over200Share": 11.7 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 546, "share": 54.7 }, { "key": "199", "label": "199 days", "count": 149, "share": 14.9 }, { "key": "198", "label": "198 days", "count": 104, "share": 10.4 }, { "key": "397", "label": "397 days", "count": 40, "share": 4 }, { "key": "84", "label": "84 days", "count": 25, "share": 2.5 }, { "key": "395", "label": "395 days", "count": 24, "share": 2.4 }, { "key": "91", "label": "91 days", "count": 12, "share": 1.2 }, { "key": "366", "label": "366 days", "count": 11, "share": 1.1 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 517 }, { "key": "rsa", "label": "RSA", "median": 198, "count": 482 } ], "grades": [ { "key": "A+", "label": "A+", "count": 230, "share": 23 }, { "key": "A", "label": "A", "count": 492, "share": 49.2 }, { "key": "B", "label": "B", "count": 31, "share": 3.1 }, { "key": "C", "label": "C", "count": 243, "share": 24.3 }, { "key": "D", "label": "D", "count": 3, "share": 0.3 }, { "key": "F", "label": "F", "count": 0, "share": 0 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 494, "share": 49.4 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 309, "share": 30.9 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 189, "share": 18.9 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 4, "share": 0.4 }, { "key": "sha512WithRSAEncryption", "label": "sha512WithRSAEncryption", "count": 3, "share": 0.3 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 257, "share": 25.7 }, { "key": "YR2", "label": "YR2", "count": 80, "share": 8 }, { "key": "YE1", "label": "YE1", "count": 71, "share": 7.1 }, { "key": "YE2", "label": "YE2", "count": 68, "share": 6.8 }, { "key": "YR1", "label": "YR1", "count": 58, "share": 5.8 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 57, "share": 5.7 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 49, "share": 4.9 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 45, "share": 4.5 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 44, "share": 4.4 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 38, "share": 3.8 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 31, "share": 3.1 }, { "key": "WE2", "label": "WE2", "count": 25, "share": 2.5 }, { "key": "Thawte TLS RSA CA G1", "label": "Thawte TLS RSA CA G1", "count": 18, "share": 1.8 }, { "key": "RapidSSL TLS RSA CA G1", "label": "RapidSSL TLS RSA CA G1", "count": 9, "share": 0.9 }, { "key": "WR3", "label": "WR3", "count": 9, "share": 0.9 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 291, "share": 29.1, "ecdsa": 282, "rsa": 9 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 277, "share": 27.7, "ecdsa": 139, "rsa": 138 }, { "key": "DigiCert", "label": "DigiCert", "count": 163, "share": 16.3, "ecdsa": 65, "rsa": 98 }, { "key": "Amazon", "label": "Amazon", "count": 112, "share": 11.2, "ecdsa": 6, "rsa": 106 }, { "key": "Sectigo", "label": "Sectigo", "count": 61, "share": 6.1, "ecdsa": 13, "rsa": 48 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 43, "share": 4.3, "ecdsa": 7, "rsa": 36 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 27, "share": 2.7, "ecdsa": 2, "rsa": 25 }, { "key": "Certum", "label": "Certum", "count": 7, "share": 0.7, "ecdsa": 0, "rsa": 7 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 6, "share": 0.6, "ecdsa": 0, "rsa": 6 }, { "key": "Microsoft", "label": "Microsoft", "count": 6, "share": 0.6, "ecdsa": 3, "rsa": 3 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 5, "share": 0.5, "ecdsa": 0, "rsa": 5 }, { "key": "Apple", "label": "Apple", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 } ], "findings": [ { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 999, "share": 100 }, { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 999, "share": 100 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 949, "share": 95 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 947, "share": 94.8 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 751, "share": 75.2 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 583, "share": 58.4 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 517, "share": 51.8 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 418, "share": 41.8 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 246, "share": 24.6 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 64, "share": 6.4 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 52, "share": 5.2 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 41, "share": 4.1 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 12, "share": 1.2 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 9, "share": 0.9 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 2, "share": 0.2 } ], "flags": { "sha1AnywhereInChain": 12, "sha1AnywhereShare": 1.2, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 999, "chainCompleteShare": 100, "tls13": 947, "tls13Share": 94.8, "legacyAccepted": 248, "legacyAcceptedShare": 24.8, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 999, "unreported": 0, "hybrid": 727, "hybridShare": 72.8, "postQuantum": 727, "postQuantumShare": 72.8, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 727, "share": 72.8 }, { "key": "x25519", "label": "x25519", "count": 236, "share": 23.6 }, { "key": "secp256r1", "label": "secp256r1", "count": 16, "share": 1.6 }, { "key": "secp384r1", "label": "secp384r1", "count": 16, "share": 1.6 }, { "key": "secp521r1", "label": "secp521r1", "count": 4, "share": 0.4 } ], "tls13": 947, "postQuantumOfTls13Share": 76.8 } }, { "id": "crux-fr", "kind": "country", "list": "crux-fr", "country": "fr", "maxRank": null, "depth": 1000, "requested": 998, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 998, "ok": 988, "failed": 10, "okShare": 99 }, "errors": [ { "key": "timeout", "label": "No handshake before the timeout", "count": 9, "share": 90 }, { "key": "tls-error", "label": "Handshake or certificate error", "count": 1, "share": 10 } ], "keyFamilies": [ { "key": "rsa", "label": "RSA", "count": 507, "share": 51.3 }, { "key": "ecdsa", "label": "ECDSA", "count": 481, "share": 48.7 } ], "keyTypes": [ { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 477, "share": 48.3 }, { "key": "RSA-2048", "label": "RSA-2048", "count": 450, "share": 45.5 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 49, "share": 5 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 8, "share": 0.8 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 4, "share": 0.4 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 927, "share": 93.8 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 61, "share": 6.2 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 756, "share": 76.5 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 224, "share": 22.7 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 8, "share": 0.8 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 4, "share": 0.4 }, { "key": "48-100", "label": "48–100 days", "count": 558, "share": 56.5 }, { "key": "101-200", "label": "101–200 days", "count": 285, "share": 28.8 }, { "key": "201-398", "label": "201–398 days", "count": 141, "share": 14.3 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 14, "median": 90, "mean": 161.8, "max": 397, "within47": 4, "within47Share": 0.4, "within100": 562, "within100Share": 56.9, "within200": 847, "within200Share": 85.7, "over200": 141, "over200Share": 14.3 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 508, "share": 51.4 }, { "key": "199", "label": "199 days", "count": 197, "share": 19.9 }, { "key": "198", "label": "198 days", "count": 65, "share": 6.6 }, { "key": "397", "label": "397 days", "count": 54, "share": 5.5 }, { "key": "366", "label": "366 days", "count": 26, "share": 2.6 }, { "key": "84", "label": "84 days", "count": 25, "share": 2.5 }, { "key": "365", "label": "365 days", "count": 20, "share": 2 }, { "key": "91", "label": "91 days", "count": 18, "share": 1.8 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 481 }, { "key": "rsa", "label": "RSA", "median": 199, "count": 507 } ], "grades": [ { "key": "A+", "label": "A+", "count": 243, "share": 24.6 }, { "key": "A", "label": "A", "count": 470, "share": 47.6 }, { "key": "B", "label": "B", "count": 48, "share": 4.9 }, { "key": "C", "label": "C", "count": 222, "share": 22.5 }, { "key": "D", "label": "D", "count": 5, "share": 0.5 }, { "key": "F", "label": "F", "count": 0, "share": 0 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 516, "share": 52.2 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 298, "share": 30.2 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 168, "share": 17 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 5, "share": 0.5 }, { "key": "sha512WithRSAEncryption", "label": "sha512WithRSAEncryption", "count": 1, "share": 0.1 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 254, "share": 25.7 }, { "key": "YR1", "label": "YR1", "count": 71, "share": 7.2 }, { "key": "YE1", "label": "YE1", "count": 64, "share": 6.5 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 63, "share": 6.4 }, { "key": "YE2", "label": "YE2", "count": 62, "share": 6.3 }, { "key": "Sectigo Public Server Authentication CA OV R36", "label": "Sectigo Public Server Authentication CA OV R36", "count": 51, "share": 5.2 }, { "key": "YR2", "label": "YR2", "count": 43, "share": 4.4 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 38, "share": 3.8 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 33, "share": 3.3 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 33, "share": 3.3 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 31, "share": 3.1 }, { "key": "WE2", "label": "WE2", "count": 25, "share": 2.5 }, { "key": "Thawte TLS RSA CA G1", "label": "Thawte TLS RSA CA G1", "count": 19, "share": 1.9 }, { "key": "GandiCert", "label": "GandiCert", "count": 18, "share": 1.8 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 18, "share": 1.8 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 289, "share": 29.3, "ecdsa": 280, "rsa": 9 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 240, "share": 24.3, "ecdsa": 126, "rsa": 114 }, { "key": "DigiCert", "label": "DigiCert", "count": 165, "share": 16.7, "ecdsa": 54, "rsa": 111 }, { "key": "Sectigo", "label": "Sectigo", "count": 100, "share": 10.1, "ecdsa": 7, "rsa": 93 }, { "key": "Amazon", "label": "Amazon", "count": 72, "share": 7.3, "ecdsa": 1, "rsa": 71 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 56, "share": 5.7, "ecdsa": 8, "rsa": 48 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 54, "share": 5.5, "ecdsa": 3, "rsa": 51 }, { "key": "Microsoft", "label": "Microsoft", "count": 5, "share": 0.5, "ecdsa": 2, "rsa": 3 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 3, "share": 0.3, "ecdsa": 0, "rsa": 3 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 2, "share": 0.2, "ecdsa": 0, "rsa": 2 }, { "key": "Apple", "label": "Apple", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 }, { "key": "Unidentified issuer", "label": "Unidentified issuer", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 } ], "findings": [ { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 988, "share": 100 }, { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 988, "share": 100 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 933, "share": 94.4 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 927, "share": 93.8 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 756, "share": 76.5 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 543, "share": 55 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 481, "share": 48.7 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 450, "share": 45.5 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 224, "share": 22.7 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 61, "share": 6.2 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 57, "share": 5.8 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 42, "share": 4.3 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 13, "share": 1.3 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 8, "share": 0.8 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 8, "share": 0.8 } ], "flags": { "sha1AnywhereInChain": 8, "sha1AnywhereShare": 0.8, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 988, "chainCompleteShare": 100, "tls13": 927, "tls13Share": 93.8, "legacyAccepted": 232, "legacyAcceptedShare": 23.5, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 985, "unreported": 3, "hybrid": 720, "hybridShare": 73.1, "postQuantum": 720, "postQuantumShare": 73.1, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 720, "share": 73.1 }, { "key": "x25519", "label": "x25519", "count": 221, "share": 22.4 }, { "key": "secp256r1", "label": "secp256r1", "count": 33, "share": 3.4 }, { "key": "secp384r1", "label": "secp384r1", "count": 8, "share": 0.8 }, { "key": "secp521r1", "label": "secp521r1", "count": 3, "share": 0.3 } ], "tls13": 927, "postQuantumOfTls13Share": 77.7 } }, { "id": "crux-jp", "kind": "country", "list": "crux-jp", "country": "jp", "maxRank": null, "depth": 1000, "requested": 993, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 993, "ok": 969, "failed": 24, "okShare": 97.6 }, "errors": [ { "key": "tls-error", "label": "Handshake or certificate error", "count": 11, "share": 45.8 }, { "key": "timeout", "label": "No handshake before the timeout", "count": 7, "share": 29.2 }, { "key": "dns-error", "label": "No public DNS answer", "count": 5, "share": 20.8 }, { "key": "unreachable", "label": "Port 443 refused or reset", "count": 1, "share": 4.2 } ], "keyFamilies": [ { "key": "rsa", "label": "RSA", "count": 699, "share": 72.1 }, { "key": "ecdsa", "label": "ECDSA", "count": 270, "share": 27.9 } ], "keyTypes": [ { "key": "RSA-2048", "label": "RSA-2048", "count": 683, "share": 70.5 }, { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 268, "share": 27.7 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 14, "share": 1.4 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 2, "share": 0.2 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 2, "share": 0.2 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 757, "share": 78.1 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 212, "share": 21.9 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 660, "share": 68.1 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 288, "share": 29.7 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 21, "share": 2.2 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 1, "share": 0.1 }, { "key": "48-100", "label": "48–100 days", "count": 256, "share": 26.4 }, { "key": "101-200", "label": "101–200 days", "count": 471, "share": 48.6 }, { "key": "201-398", "label": "201–398 days", "count": 241, "share": 24.9 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 30, "median": 198, "mean": 216.2, "max": 397, "within47": 1, "within47Share": 0.1, "within100": 257, "within100Share": 26.5, "within200": 728, "within200Share": 75.1, "over200": 241, "over200Share": 24.9 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 228, "share": 23.5 }, { "key": "199", "label": "199 days", "count": 217, "share": 22.4 }, { "key": "198", "label": "198 days", "count": 212, "share": 21.9 }, { "key": "397", "label": "397 days", "count": 72, "share": 7.4 }, { "key": "395", "label": "395 days", "count": 49, "share": 5.1 }, { "key": "394", "label": "394 days", "count": 41, "share": 4.2 }, { "key": "84", "label": "84 days", "count": 23, "share": 2.4 }, { "key": "396", "label": "396 days", "count": 12, "share": 1.2 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 270 }, { "key": "rsa", "label": "RSA", "median": 199, "count": 699 } ], "grades": [ { "key": "A+", "label": "A+", "count": 52, "share": 5.4 }, { "key": "A", "label": "A", "count": 494, "share": 51 }, { "key": "B", "label": "B", "count": 134, "share": 13.8 }, { "key": "C", "label": "C", "count": 285, "share": 29.4 }, { "key": "D", "label": "D", "count": 3, "share": 0.3 }, { "key": "F", "label": "F", "count": 1, "share": 0.1 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 699, "share": 72.1 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 133, "share": 13.7 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 133, "share": 13.7 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 4, "share": 0.4 } ], "issuers": [ { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 124, "share": 12.8 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 119, "share": 12.3 }, { "key": "WE1", "label": "WE1", "count": 102, "share": 10.5 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 86, "share": 8.9 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 67, "share": 6.9 }, { "key": "Cybertrust Japan SureServer CA G4", "label": "Cybertrust Japan SureServer CA G4", "count": 66, "share": 6.8 }, { "key": "YR2", "label": "YR2", "count": 35, "share": 3.6 }, { "key": "Cybertrust Japan SureServer EV CA G3", "label": "Cybertrust Japan SureServer EV CA G3", "count": 34, "share": 3.5 }, { "key": "YR1", "label": "YR1", "count": 34, "share": 3.5 }, { "key": "GlobalSign RSA OV SSL CA 2018", "label": "GlobalSign RSA OV SSL CA 2018", "count": 32, "share": 3.3 }, { "key": "YE1", "label": "YE1", "count": 31, "share": 3.2 }, { "key": "GeoTrust TLS RSA CA G1", "label": "GeoTrust TLS RSA CA G1", "count": 27, "share": 2.8 }, { "key": "DigiCert EV RSA CA G2", "label": "DigiCert EV RSA CA G2", "count": 23, "share": 2.4 }, { "key": "WE2", "label": "WE2", "count": 23, "share": 2.4 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 15, "share": 1.5 } ], "caGroups": [ { "key": "Amazon", "label": "Amazon", "count": 247, "share": 25.5, "ecdsa": 4, "rsa": 243 }, { "key": "DigiCert", "label": "DigiCert", "count": 225, "share": 23.2, "ecdsa": 90, "rsa": 135 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 139, "share": 14.3, "ecdsa": 1, "rsa": 138 }, { "key": "Google Trust Services", "label": "Google Trust Services", "count": 132, "share": 13.6, "ecdsa": 126, "rsa": 6 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 115, "share": 11.9, "ecdsa": 46, "rsa": 69 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 85, "share": 8.8, "ecdsa": 0, "rsa": 85 }, { "key": "Sectigo", "label": "Sectigo", "count": 21, "share": 2.2, "ecdsa": 2, "rsa": 19 }, { "key": "Microsoft", "label": "Microsoft", "count": 2, "share": 0.2, "ecdsa": 1, "rsa": 1 }, { "key": "Apple", "label": "Apple", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 } ], "findings": [ { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 969, "share": 100 }, { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 969, "share": 100 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 927, "share": 95.7 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 757, "share": 78.1 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 683, "share": 70.5 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 660, "share": 68.1 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 288, "share": 29.7 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 270, "share": 27.9 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 252, "share": 26 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 212, "share": 21.9 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 29, "share": 3 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 21, "share": 2.2 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 16, "share": 1.7 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 13, "share": 1.3 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 3, "share": 0.3 } ], "flags": { "sha1AnywhereInChain": 3, "sha1AnywhereShare": 0.3, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 969, "chainCompleteShare": 100, "tls13": 757, "tls13Share": 78.1, "legacyAccepted": 309, "legacyAcceptedShare": 31.9, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 961, "unreported": 8, "hybrid": 557, "hybridShare": 58, "postQuantum": 557, "postQuantumShare": 58, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 557, "share": 58 }, { "key": "x25519", "label": "x25519", "count": 251, "share": 26.1 }, { "key": "secp256r1", "label": "secp256r1", "count": 152, "share": 15.8 }, { "key": "secp384r1", "label": "secp384r1", "count": 1, "share": 0.1 } ], "tls13": 757, "postQuantumOfTls13Share": 73.6 } }, { "id": "crux-cn", "kind": "country", "list": "crux-cn", "country": "cn", "maxRank": null, "depth": 1000, "requested": 997, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 997, "ok": 963, "failed": 34, "okShare": 96.6 }, "errors": [ { "key": "dns-error", "label": "No public DNS answer", "count": 15, "share": 44.1 }, { "key": "private-address", "label": "Resolves to reserved address space", "count": 8, "share": 23.5 }, { "key": "timeout", "label": "No handshake before the timeout", "count": 8, "share": 23.5 }, { "key": "unreachable", "label": "Port 443 refused or reset", "count": 3, "share": 8.8 } ], "keyFamilies": [ { "key": "ecdsa", "label": "ECDSA", "count": 531, "share": 55.1 }, { "key": "rsa", "label": "RSA", "count": 432, "share": 44.9 } ], "keyTypes": [ { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 526, "share": 54.6 }, { "key": "RSA-2048", "label": "RSA-2048", "count": 428, "share": 44.4 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 5, "share": 0.5 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 3, "share": 0.3 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 1, "share": 0.1 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 846, "share": 87.9 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 117, "share": 12.1 } ], "legacyTls": [ { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 559, "share": 58 }, { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 371, "share": 38.5 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 33, "share": 3.4 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 2, "share": 0.2 }, { "key": "48-100", "label": "48–100 days", "count": 559, "share": 58 }, { "key": "101-200", "label": "101–200 days", "count": 256, "share": 26.6 }, { "key": "201-398", "label": "201–398 days", "count": 146, "share": 15.2 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 30, "median": 90, "mean": 162.8, "max": 397, "within47": 2, "within47Share": 0.2, "within100": 561, "within100Share": 58.3, "within200": 817, "within200Share": 84.8, "over200": 146, "over200Share": 15.2 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 516, "share": 53.6 }, { "key": "199", "label": "199 days", "count": 188, "share": 19.5 }, { "key": "198", "label": "198 days", "count": 49, "share": 5.1 }, { "key": "397", "label": "397 days", "count": 42, "share": 4.4 }, { "key": "365", "label": "365 days", "count": 34, "share": 3.5 }, { "key": "84", "label": "84 days", "count": 27, "share": 2.8 }, { "key": "395", "label": "395 days", "count": 24, "share": 2.5 }, { "key": "91", "label": "91 days", "count": 11, "share": 1.1 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 531 }, { "key": "rsa", "label": "RSA", "median": 199, "count": 432 } ], "grades": [ { "key": "A+", "label": "A+", "count": 115, "share": 11.9 }, { "key": "A", "label": "A", "count": 206, "share": 21.4 }, { "key": "B", "label": "B", "count": 79, "share": 8.2 }, { "key": "C", "label": "C", "count": 549, "share": 57 }, { "key": "D", "label": "D", "count": 14, "share": 1.5 }, { "key": "F", "label": "F", "count": 0, "share": 0 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 455, "share": 47.2 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 404, "share": 42 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 93, "share": 9.7 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 11, "share": 1.1 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 361, "share": 37.5 }, { "key": "RapidSSL TLS RSA CA G1", "label": "RapidSSL TLS RSA CA G1", "count": 47, "share": 4.9 }, { "key": "YE1", "label": "YE1", "count": 43, "share": 4.5 }, { "key": "YR2", "label": "YR2", "count": 37, "share": 3.8 }, { "key": "DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1", "label": "DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1", "count": 33, "share": 3.4 }, { "key": "GlobalSign RSA OV SSL CA 2018", "label": "GlobalSign RSA OV SSL CA 2018", "count": 33, "share": 3.4 }, { "key": "GlobalSign GCC R46 OV TLS CA 2025", "label": "GlobalSign GCC R46 OV TLS CA 2025", "count": 29, "share": 3 }, { "key": "YR1", "label": "YR1", "count": 29, "share": 3 }, { "key": "YE2", "label": "YE2", "count": 28, "share": 2.9 }, { "key": "GeoTrust G2 TLS CN RSA4096 SHA256 2022 CA1", "label": "GeoTrust G2 TLS CN RSA4096 SHA256 2022 CA1", "count": 27, "share": 2.8 }, { "key": "WE2", "label": "WE2", "count": 27, "share": 2.8 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 26, "share": 2.7 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 19, "share": 2 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 19, "share": 2 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 16, "share": 1.7 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 394, "share": 40.9, "ecdsa": 389, "rsa": 5 }, { "key": "DigiCert", "label": "DigiCert", "count": 184, "share": 19.1, "ecdsa": 35, "rsa": 149 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 137, "share": 14.2, "ecdsa": 71, "rsa": 66 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 89, "share": 9.2, "ecdsa": 22, "rsa": 67 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 81, "share": 8.4, "ecdsa": 10, "rsa": 71 }, { "key": "Amazon", "label": "Amazon", "count": 36, "share": 3.7, "ecdsa": 1, "rsa": 35 }, { "key": "Sectigo", "label": "Sectigo", "count": 18, "share": 1.9, "ecdsa": 2, "rsa": 16 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 9, "share": 0.9, "ecdsa": 0, "rsa": 9 }, { "key": "Apple", "label": "Apple", "count": 6, "share": 0.6, "ecdsa": 0, "rsa": 6 }, { "key": "Microsoft", "label": "Microsoft", "count": 5, "share": 0.5, "ecdsa": 1, "rsa": 4 }, { "key": "Certum", "label": "Certum", "count": 3, "share": 0.3, "ecdsa": 0, "rsa": 3 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 } ], "findings": [ { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 963, "share": 100 }, { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 961, "share": 99.8 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 924, "share": 96 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 846, "share": 87.9 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 559, "share": 58 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 548, "share": 56.9 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 531, "share": 55.1 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 428, "share": 44.4 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 371, "share": 38.5 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 117, "share": 12.1 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 35, "share": 3.6 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 33, "share": 3.4 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 20, "share": 2.1 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 19, "share": 2 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 4, "share": 0.4 }, { "key": "chain-incomplete", "label": "Chain incomplete as served", "title": "Chain incomplete as served", "severity": "warn", "count": 2, "share": 0.2 } ], "flags": { "sha1AnywhereInChain": 35, "sha1AnywhereShare": 3.6, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 961, "chainCompleteShare": 99.8, "tls13": 846, "tls13Share": 87.9, "legacyAccepted": 592, "legacyAcceptedShare": 61.5, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 962, "unreported": 1, "hybrid": 608, "hybridShare": 63.2, "postQuantum": 608, "postQuantumShare": 63.2, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 608, "share": 63.2 }, { "key": "x25519", "label": "x25519", "count": 321, "share": 33.4 }, { "key": "secp256r1", "label": "secp256r1", "count": 28, "share": 2.9 }, { "key": "secp384r1", "label": "secp384r1", "count": 4, "share": 0.4 }, { "key": "secp521r1", "label": "secp521r1", "count": 1, "share": 0.1 } ], "tls13": 846, "postQuantumOfTls13Share": 71.9 } }, { "id": "crux-tw", "kind": "country", "list": "crux-tw", "country": "tw", "maxRank": null, "depth": 1000, "requested": 992, "excluded": 0, "notAttempted": 0, "summary": { "totals": { "attempted": 992, "ok": 947, "failed": 45, "okShare": 95.5 }, "errors": [ { "key": "timeout", "label": "No handshake before the timeout", "count": 26, "share": 57.8 }, { "key": "dns-error", "label": "No public DNS answer", "count": 17, "share": 37.8 }, { "key": "private-address", "label": "Resolves to reserved address space", "count": 1, "share": 2.2 }, { "key": "tls-error", "label": "Handshake or certificate error", "count": 1, "share": 2.2 } ], "keyFamilies": [ { "key": "rsa", "label": "RSA", "count": 505, "share": 53.3 }, { "key": "ecdsa", "label": "ECDSA", "count": 442, "share": 46.7 } ], "keyTypes": [ { "key": "RSA-2048", "label": "RSA-2048", "count": 490, "share": 51.7 }, { "key": "ECDSA P-256", "label": "ECDSA P-256", "count": 441, "share": 46.6 }, { "key": "RSA-3072", "label": "RSA-3072", "count": 8, "share": 0.8 }, { "key": "RSA-4096", "label": "RSA-4096", "count": 7, "share": 0.7 }, { "key": "ECDSA P-384", "label": "ECDSA P-384", "count": 1, "share": 0.1 } ], "protocols": [ { "key": "TLSv1.3", "label": "TLS 1.3", "count": 813, "share": 85.9 }, { "key": "TLSv1.2", "label": "TLS 1.2", "count": 134, "share": 14.1 } ], "legacyTls": [ { "key": "refused", "label": "Refused TLS 1.0 and 1.1", "count": 533, "share": 56.3 }, { "key": "accepted:TLSv1.1,TLSv1", "label": "Accepted TLS 1.0 and TLS 1.1", "count": 397, "share": 41.9 }, { "key": "accepted:TLSv1.1", "label": "Accepted TLS 1.1", "count": 17, "share": 1.8 } ], "lifetimeHistogram": [ { "key": "<=47", "label": "≤ 47 days", "count": 2, "share": 0.2 }, { "key": "48-100", "label": "48–100 days", "count": 495, "share": 52.3 }, { "key": "101-200", "label": "101–200 days", "count": 283, "share": 29.9 }, { "key": "201-398", "label": "201–398 days", "count": 167, "share": 17.6 }, { "key": ">398", "label": "> 398 days", "count": 0, "share": 0 } ], "lifetimeStats": { "min": 30, "median": 90, "mean": 173.6, "max": 397, "within47": 2, "within47Share": 0.2, "within100": 497, "within100Share": 52.5, "within200": 780, "within200Share": 82.4, "over200": 167, "over200Share": 17.6 }, "lifetimeModes": [ { "key": "90", "label": "90 days", "count": 442, "share": 46.7 }, { "key": "199", "label": "199 days", "count": 153, "share": 16.2 }, { "key": "198", "label": "198 days", "count": 115, "share": 12.1 }, { "key": "397", "label": "397 days", "count": 41, "share": 4.3 }, { "key": "84", "label": "84 days", "count": 31, "share": 3.3 }, { "key": "365", "label": "365 days", "count": 25, "share": 2.6 }, { "key": "395", "label": "395 days", "count": 20, "share": 2.1 }, { "key": "394", "label": "394 days", "count": 15, "share": 1.6 } ], "lifetimeByKeyFamily": [ { "key": "ecdsa", "label": "ECDSA", "median": 90, "count": 442 }, { "key": "rsa", "label": "RSA", "median": 199, "count": 505 } ], "grades": [ { "key": "A+", "label": "A+", "count": 108, "share": 11.4 }, { "key": "A", "label": "A", "count": 320, "share": 33.8 }, { "key": "B", "label": "B", "count": 120, "share": 12.7 }, { "key": "C", "label": "C", "count": 389, "share": 41.1 }, { "key": "D", "label": "D", "count": 9, "share": 1 }, { "key": "F", "label": "F", "count": 1, "share": 0.1 } ], "signatureAlgorithms": [ { "key": "sha256WithRSAEncryption", "label": "sha256WithRSAEncryption", "count": 527, "share": 55.6 }, { "key": "ecdsa-with-SHA256", "label": "ecdsa-with-SHA256", "count": 318, "share": 33.6 }, { "key": "ecdsa-with-SHA384", "label": "ecdsa-with-SHA384", "count": 98, "share": 10.3 }, { "key": "sha384WithRSAEncryption", "label": "sha384WithRSAEncryption", "count": 4, "share": 0.4 } ], "issuers": [ { "key": "WE1", "label": "WE1", "count": 281, "share": 29.7 }, { "key": "TWCA Secure SSL Certification Authority", "label": "TWCA Secure SSL Certification Authority", "count": 65, "share": 6.9 }, { "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "label": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "count": 56, "share": 5.9 }, { "key": "TWCA SSL Certification Authority", "label": "TWCA SSL Certification Authority", "count": 56, "share": 5.9 }, { "key": "YE1", "label": "YE1", "count": 37, "share": 3.9 }, { "key": "YR1", "label": "YR1", "count": 35, "share": 3.7 }, { "key": "YR2", "label": "YR2", "count": 34, "share": 3.6 }, { "key": "Amazon RSA 2048 M01", "label": "Amazon RSA 2048 M01", "count": 33, "share": 3.5 }, { "key": "Amazon RSA 2048 M04", "label": "Amazon RSA 2048 M04", "count": 32, "share": 3.4 }, { "key": "WE2", "label": "WE2", "count": 31, "share": 3.3 }, { "key": "YE2", "label": "YE2", "count": 30, "share": 3.2 }, { "key": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "label": "DigiCert Global G3 TLS ECC SHA384 2020 CA1", "count": 28, "share": 3 }, { "key": "Sectigo Public Server Authentication CA OV R36", "label": "Sectigo Public Server Authentication CA OV R36", "count": 23, "share": 2.4 }, { "key": "GlobalSign RSA OV SSL CA 2018", "label": "GlobalSign RSA OV SSL CA 2018", "count": 20, "share": 2.1 }, { "key": "Sectigo Public Server Authentication CA DV R36", "label": "Sectigo Public Server Authentication CA DV R36", "count": 18, "share": 1.9 } ], "caGroups": [ { "key": "Google Trust Services", "label": "Google Trust Services", "count": 329, "share": 34.7, "ecdsa": 313, "rsa": 16 }, { "key": "Other / smaller CAs", "label": "Other / smaller CAs", "count": 160, "share": 16.9, "ecdsa": 3, "rsa": 157 }, { "key": "Let's Encrypt", "label": "Let's Encrypt", "count": 136, "share": 14.4, "ecdsa": 67, "rsa": 69 }, { "key": "DigiCert", "label": "DigiCert", "count": 133, "share": 14, "ecdsa": 53, "rsa": 80 }, { "key": "Amazon", "label": "Amazon", "count": 65, "share": 6.9, "ecdsa": 0, "rsa": 65 }, { "key": "Sectigo", "label": "Sectigo", "count": 51, "share": 5.4, "ecdsa": 1, "rsa": 50 }, { "key": "GlobalSign", "label": "GlobalSign", "count": 47, "share": 5, "ecdsa": 3, "rsa": 44 }, { "key": "GoDaddy", "label": "GoDaddy", "count": 15, "share": 1.6, "ecdsa": 0, "rsa": 15 }, { "key": "Microsoft", "label": "Microsoft", "count": 6, "share": 0.6, "ecdsa": 2, "rsa": 4 }, { "key": "Certainly (Fastly)", "label": "Certainly (Fastly)", "count": 2, "share": 0.2, "ecdsa": 0, "rsa": 2 }, { "key": "Certum", "label": "Certum", "count": 2, "share": 0.2, "ecdsa": 0, "rsa": 2 }, { "key": "Apple", "label": "Apple", "count": 1, "share": 0.1, "ecdsa": 0, "rsa": 1 } ], "findings": [ { "key": "pqc-migration-ahead", "label": "Classical algorithm — migration ahead", "title": "Classical algorithm — migration ahead", "severity": "info", "count": 947, "share": 100 }, { "key": "chain-complete", "label": "Chain complete as served", "title": "Chain complete as served", "severity": "ok", "count": 943, "share": 99.6 }, { "key": "cert-valid", "label": "Within validity period", "title": "Within validity period", "severity": "ok", "count": 902, "share": 95.2 }, { "key": "tls13", "label": "TLS 1.3 negotiated", "title": "TLS 1.3 negotiated", "severity": "ok", "count": 813, "share": 85.9 }, { "key": "legacy-tls-refused", "label": "Legacy TLS refused", "title": "Legacy TLS refused", "severity": "ok", "count": 533, "share": 56.3 }, { "key": "key-rsa-2048", "label": "RSA-2048 — fine, but not compact", "title": "RSA-2048 — fine, but not compact", "severity": "info", "count": 490, "share": 51.7 }, { "key": "cert-short-lifetime", "label": "Lifetime of 90 days or less", "title": "Lifetime of 90 days or less", "severity": "ok", "count": 487, "share": 51.4 }, { "key": "key-modern", "label": "Modern key (ECDSA / EdDSA)", "title": "Modern key (ECDSA / EdDSA)", "severity": "ok", "count": 442, "share": 46.7 }, { "key": "tls10-accepted", "label": "TLS 1.0 accepted", "title": "TLS 1.0 accepted", "severity": "critical", "count": 397, "share": 41.9 }, { "key": "no-tls13", "label": "TLS 1.3 not offered", "title": "TLS 1.3 not offered", "severity": "warn", "count": 134, "share": 14.1 }, { "key": "chain-weak-signature-hash", "label": "SHA-1 signature above the leaf", "title": "SHA-1 signature above the leaf", "severity": "warn", "count": 35, "share": 3.7 }, { "key": "cert-renewal-window", "label": "In the renewal window (< 30 days)", "title": "In the renewal window (< 30 days)", "severity": "info", "count": 34, "share": 3.6 }, { "key": "tls11-accepted", "label": "TLS 1.1 accepted", "title": "TLS 1.1 accepted", "severity": "warn", "count": 17, "share": 1.8 }, { "key": "key-rsa-large", "label": "RSA above 2048 bits", "title": "RSA above 2048 bits", "severity": "ok", "count": 15, "share": 1.6 }, { "key": "cert-expiring-soon", "label": "Expires within 14 days", "title": "Expires within 14 days", "severity": "warn", "count": 11, "share": 1.2 }, { "key": "chain-incomplete", "label": "Chain incomplete as served", "title": "Chain incomplete as served", "severity": "warn", "count": 4, "share": 0.4 } ], "flags": { "sha1AnywhereInChain": 35, "sha1AnywhereShare": 3.7, "sha1Leaf": 0, "sha1LeafShare": 0, "pqcKeyOrSignature": 0, "pqcShare": 0, "chainComplete": 943, "chainCompleteShare": 99.6, "tls13": 813, "tls13Share": 85.9, "legacyAccepted": 414, "legacyAcceptedShare": 43.7, "rsaBelow2048": 0, "expired": 0 } }, "pq": { "measured": 942, "unreported": 5, "hybrid": 629, "hybridShare": 66.8, "postQuantum": 629, "postQuantumShare": 66.8, "groups": [ { "key": "X25519MLKEM768", "label": "X25519MLKEM768", "count": 629, "share": 66.8 }, { "key": "x25519", "label": "x25519", "count": 203, "share": 21.5 }, { "key": "secp256r1", "label": "secp256r1", "count": 88, "share": 9.3 }, { "key": "secp384r1", "label": "secp384r1", "count": 17, "share": 1.8 }, { "key": "secp521r1", "label": "secp521r1", "count": 5, "share": 0.5 } ], "tls13": 813, "postQuantumOfTls13Share": 77.4 } } ], "panel": { "previous": "2026-08", "hosts": 346, "metrics": { "hybridShare": { "before": null, "after": 55.8 }, "ecdsaShare": { "before": 38.7, "after": 39.3 }, "rsaShare": { "before": 61.3, "after": 60.7 }, "tls13Share": { "before": 84.7, "after": 85.3 }, "legacyAcceptedShare": { "before": 27.7, "after": 26.3 }, "within100Share": { "before": 47.4, "after": 48 }, "within47Share": { "before": 1.2, "after": 1.2 }, "medianLifetime": { "before": 181, "after": 184 }, "gradeAShare": { "before": 60.1, "after": 64.2 }, "okShare": { "before": null, "after": null } }, "transitions": { "hybridAdopted": null, "hybridDropped": null, "rsaToEcdsa": 3, "ecdsaToRsa": 1, "tls13Gained": 2, "tls13Lost": 0, "legacyRefusedNow": 7, "legacyAcceptedNow": 2, "sha1Dropped": 97, "sha1Added": 0 } } }