This morning we opened a connection to each of the ten thousand most visited websites and read the certificate it served. It is the same check a browser runs in the instant before it shows the padlock. It asks three things: whether the certificate is still in date, whether it leads back to an authority the browser trusts, and whether it belongs to the site being visited.
Most sites answered all three cleanly. 8,208 of them completed a secure connection, and 7,536 of those served a certificate with nothing wrong. That is about nine in ten.
The other 85 are the reason for this report.
85 sites a browser will not trust
Of the sites that answered, 85 are serving a certificate a browser refuses to accept at all. 42 have expired: the date on the certificate has passed, in several cases by more than a year, and in a few by more than five. 43 more have not expired but do not connect back to a trusted authority, because a link in the chain is missing or was never trusted. In both cases the visitor does not see the site. They see a full page warning that the connection is not safe.
All 85 sit inside the ten thousand addresses that carry the most traffic on the web.
The rest of what we found
Beyond those 85, another group serves a certificate that warns, or that does not match the site you asked for.
- 191 served a certificate for a different name than the one we requested. This is the largest group and the least settled. Many are sites that secure their www address but not the bare domain, so we want to look at each one before saying more about them.
- 62 answered on the secure port but never completed the connection. The fault sits below the certificate, in the configuration.
- 334 more are valid today but expire within the next 30 days.
Here is the full count of the 8,208 sites that answered a secure connection.
| State | Sites | Share | In a browser |
|---|---|---|---|
| Healthy | 7,536 | 91.8% | Loads normally |
| Expiring within 30 days | 334 | 4.1% | Loads, for now |
| Wrong host | 191 | 2.3% | Warns or misbehaves |
| Handshake failed | 62 | 0.8% | Will not connect |
| Broken chain | 43 | 0.5% | Rejected outright |
| Expired | 42 | 0.5% | Rejected outright |
A further 1,755 sites did not answer on the secure port at all, and are not counted in the table above.
The rate holds as you scan deeper
The share barely moved as we went further down the list: 4.9 percent of the top thousand, 4.1 percent of the top ten thousand.
Because it stays steady as the sample grows, it describes the web at large and not a few unlucky sites at the very top of a list. A broken certificate is not a rare accident that only befalls small sites. It is a steady background rate that runs all the way through the most visited pages on the internet.
How we ran the scan
Every site was contacted directly and its certificate read at the moment of the scan. None of this comes from a stored feed or an old report. When a site was listed by its bare name but only serves a secure connection on its www address, we checked there as well, so a site is counted as unreachable only when it genuinely did not answer.
We are not naming any site in this first report. The per-site detail exists and every count here can be reproduced. The aggregate on its own shows how much of the visible web is running on a certificate that has already failed, or is close to it.
Why this keeps happening
Certificates are getting shorter lived. The maximum lifetime is being cut to 47 days by 2029, which means a site will renew about eight times a year. Each renewal is a step that can be missed, and none of these failures produced an error in a log the site owner was watching. The certificate simply lapsed, or the chain quietly stopped building, and the site kept looking fine from the inside.
Check your own before you are on next month's list
The useful thing here is not the list. It is knowing whether your own certificate is one of the 85, and you cannot tell that from your own machine, where the browser has often cached the missing piece the rest of the world is missing.
You can check any host from outside your own network for free, without signing up. It reads the certificate your visitors actually receive, validates the whole chain and the hostnames on it, and shows you what the world sees. That is the ten second version of the scan we just ran across ten thousand sites.