SSLwatch collects TLS certificate information from vantage points across the globe and turns it into statistics for the projects that depend on them — which issuers are trusted, which protocols are served, how fast the ecosystem is changing, and where.
Edition № 1Scanning continuouslyStatistics updated hourlyFree and open
Vantage points, six continents24
Certificates observed to date1,812,440,117
Hosts revisited every day41,208,556
Projects with their own statistics38
Scanners in two dozen locations complete a TLS handshake with every reachable host and record the chain it served, the protocol it negotiated and the ciphers it offered. The same host is seen from several places, so regional differences — a certificate served in one country and not another — show up as data, not anecdote.
Each project that uses SSLwatch gets its own set of figures: issuer share, key sizes, certificate lifetimes, protocol versions, revocation behaviour. Time series are kept from the first observation onward, so a change in policy can be read against the months before it.
Aggregates are free to read and free to cite. Raw observations are kept for the researchers who ask for them, with the hostnames that could identify a person removed. Methods are written down beside the figures they produce, and corrections are printed where the mistake was.
| Project | What it measures | Vantage points | Since |
|---|---|---|---|
| Certificate lifetimes | How quickly the web is moving to shorter validity periods | 24 | 2024 |
| Issuer share | Which authorities sign the certificates that are actually served | 24 | 2024 |
| Protocol adoption | TLS 1.3 against the versions it is replacing, by region | 24 | 2025 |
| Post-quantum key exchange | Hosts negotiating hybrid key agreement, counted weekly | 18 | 2025 |
| Revocation in practice | Stapled OCSP responses, CRL reachability and revoked chains still served | 12 | 2026 |
Running a project that needs certificate data? Statistics for new projects are added on request — write to us.
“A certificate is a promise made in public. Someone should be keeping count of how those promises are kept.”
Enter a domain and our scanners will skip it entirely — the host and every name beneath it. No handshake, no record, no row in any statistic. The exclusion takes effect within the hour and stays in place until you ask us to lift it.
The scanners are running and the archive is filling. Leave an address and we will send one message when the figures are published — nothing else.