Certificates

Who issues the certificates the directory's agents are served under, of what kind and for how long, and what the connections they arrived on agreed. Everything here was read off a handshake agenttru.st made anyway, to verify a listing.

Counted per registrable domain, with listings and distinct certificates beside: one platform's thousands of hostnames are one decision about certificates, made once, and counted by hostname that platform would read as the whole web. A domain whose listings differ — two certificate authorities, two key exchanges — is counted under each, so a column's shares can add to more than 100%. 73,519 of 73,519 listings, on 64,334 of 64,334 domains, have a certificate on record.

Post-quantum key exchange

94.3% of domains — 60,461 of 64,139 — agreed a post-quantum hybrid key exchange with our checker (68,108 of 73,279 listings).

Recorded for 73,279 of 73,519 listings with a certificate, since 3 Oct 2026: the rest fill in as the hub re-checks each listing, once a week. Every connection was made by agenttru.st's checker (go1.26.10, go1.26.8, go1.26.9), which offers a post-quantum hybrid first. It describes whatever answered — often a CDN's edge, not the operator's own server — and "not agreed" means not agreed with us, not that the server cannot. What this means.

Shares are of the 64,139 domains whose connection is on record.

TLS 1.2 cannot carry a post-quantum key exchange; it needs TLS 1.3.

By hosting network

Operators serving at least 25 domains whose connection is on record, counted by domain like everything here. Fewer would make a share a statement about a handful of customers, with an operator's name on it. Where a CDN fronts a host, its edge chose the key exchange.

Certificates are classical, all of them. A post-quantum key exchange protects traffic recorded today from decryption later; it does not stop a future quantum attacker impersonating a server. That needs post-quantum certificates, which publicly trusted certificate authorities may not issue yet — the Baseline Requirements allow only RSA and ECDSA keys.

Who issues them

Spellings of one authority's name — "Google Trust Services" and "Google Trust Services LLC" — are counted as one.

Issuing certificates

The intermediate the server presented: which of an authority's products signed the certificate, and with what key. Recorded with the key and chain, for 73,279 listings so far.

What the authority checked

Domain validation checks control of the hostname and nothing about who operates it. More on certificates.

How long they last

Days are counted as the Baseline Requirements count them: from the first second of validity to the last, inclusive, any part of a day as a whole one. Since 15 March 2026 they allow a certificate at most 200 days; from 15 March 2027, 100; from 15 March 2029, 47. A certificate issued for 10 days or less is short-lived by design and replaced before it lapses.

Keys

Recorded for 73,279 of 73,519 listings with a certificate so far; shares are of the 64,139 domains described.

Wildcards and shared certificates

12,692 domains (19.7%) serve their agents under a wildcard certificate, whose other hostnames Certificate Transparency does not reveal. 2,717 certificates are presented by more than one listing, covering 6,966 listings between them.