stat --top 10
TLS certificate statistics
Aggregate numbers from our Internet-wide TLS certificate and SSH host key scan of the public IPv4 address space. Open to everyone, no account needed, refreshed daily.
The index currently holds 9,739,025 distinct certificates and 66,970 SSH host keys seen on 18,397,828 endpoints across 18,385,935 unique IP addresses and 15,457,793 unique domain names. Below: the busiest hosts, the most widely deployed certificates, the largest certificate authorities, key algorithms, TLS versions, SSH host key types and server software, and how much of the Internet still serves self-signed or expired certificates.
Top IPs by domain count
Hosts presenting certificates for the most distinct domain names, last octet hidden
| IP | domains |
|---|---|
| 18.196.93. | 2,163 |
| 5.178.111. | 1,999 |
| 18.198.61. | 1,852 |
| 4.152.224. | 1,470 |
| 3.125.20. | 1,428 |
| 50.16.50. | 1,322 |
| 3.208.60. | 1,319 |
| 3.108.183. | 1,304 |
| 13.205.197. | 1,290 |
| 43.205.53. | 1,274 |
Most widely used certificates
Non-CA certificates presented on the most distinct IPs
| common name | IPs |
|---|---|
|
a248.e.akamai.net
by DigiCert Inc |
126,760 |
|
*.cloudfront.net
by Amazon |
88,770 |
|
*.hstgr.io
by Let's Encrypt |
76,191 |
|
*.home.pl
by home.pl S.A. |
67,841 |
|
*.cloudwaysapps.com
by SSL Corporation |
64,624 |
|
*.cdn.myqcloud.com
by WoTrus CA Limited |
55,658 |
|
*.us-west-2.es.amazonaws.com
by Amazon |
55,065 |
|
*.us-east-1.es.amazonaws.com
by Amazon |
44,738 |
|
ip-hoarder.cloudfront.aws.dev
by Amazon |
42,177 |
|
*.us-east-1.es.amazonaws.com
by Amazon |
38,375 |
Top certificate issuers
Certificate authorities that signed the most certificates
| issuer | certificates |
|---|---|
| Let's Encrypt | 3,464,258 |
| Amazon | 956,982 |
| DigiCert Inc | 483,906 |
| TRAEFIK DEFAULT CERT | 361,336 |
| Sectigo Limited | 293,975 |
| kubernetes | 215,207 |
| Google Trust Services | 211,237 |
| Microsoft Corporation | 173,845 |
| GlobalSign nv-sa | 124,690 |
| DrayTek Corp. | 116,127 |
Top subject organizations
Organizations named on the most certificates
| organization | certificates |
|---|---|
| Microsoft Corporation | 182,449 |
| DrayTek Corp. | 116,113 |
| Acme Co | 109,425 |
| CloudFlare, Inc. | 95,292 |
| Fortinet Ltd. | 58,798 |
| LANCOM Systems | 49,740 |
| HTTPS Management Certificate for SonicWALL (self-signed) | 46,109 |
| WatchGuard | 42,494 |
| Unspecified | 41,822 |
| NA | 40,023 |
Most common certificate names
Common names seen across the most distinct IPs
| common name | IPs |
|---|---|
| traefik default cert | 357,509 |
| kube-apiserver | 235,155 |
| cloudflare origin certificate | 131,704 |
| localhost | 130,274 |
| a248.e.akamai.net | 127,437 |
| vigor router | 125,214 |
| *.us-east-1.es.amazonaws.com | 119,838 |
| kubernetes ingress controller fake certificate | 117,897 |
| invalid2.invalid | 94,910 |
| *.search.windows.net | 90,654 |
Key algorithms
Public key type and size across all certificates
| algorithm | certificates |
|---|---|
| RSA 2048 | 6,842,523 |
| EC 256 | 2,096,972 |
| RSA 4096 | 548,436 |
| RSA 3072 | 101,352 |
| EC 384 | 99,752 |
| RSA 1024 | 96,611 |
| other 256 | 2,968 |
| RSA 8192 | 720 |
| RSA 1536 | 700 |
| EC 521 | 587 |
| RSA 1040 | 77 |
| RSA 2047 | 59 |
SSH host key algorithms
Host key type and size across all SSH servers, certificates counted separately
| algorithm | host keys |
|---|---|
| ED25519 256 | 21,275 |
| ECDSA 256 | 20,867 |
| RSA 3072 | 16,384 |
| RSA 2048 | 5,924 |
| DSA 1024 | 1,128 |
| RSA 4096 | 452 |
| ECDSA 521 | 219 |
| RSA 1024 | 214 |
| ECDSA 256 certificate | 139 |
| ED25519 256 certificate | 138 |
| ECDSA 384 | 125 |
| RSA 2048 certificate | 100 |
Most widely used SSH host keys
Host keys presented on the most distinct IPs, a sign of cloned images or shared appliances, fingerprints partly hidden
| host key | IPs |
|---|---|
|
SHA256:G7LS93qeuGAhqhpXIdPHl
ED25519 256
|
1,979 |
|
SHA256:xizWuIK6WVY5Uv3WL/C1V
ECDSA 256
|
1,979 |
|
SHA256:IHATeJ/Yg3dsqfqRtGXHY
RSA 2048
|
1,979 |
|
SHA256:V0ixxURoRbUsfJoR6HY/D
RSA 2048
|
221 |
|
SHA256:hIyhtZuytZGGu24fXqP/r
ECDSA 256
|
221 |
|
SHA256:sGAtjF8cKAf520dxDwJkl
ED25519 256
|
220 |
|
SHA256:lyvYHyfpvEFiurQygNHTG
DSA 1024
|
206 |
|
SHA256:1E/JzbhdFw8rJf3yp51fD
RSA 2048
|
202 |
|
SHA256:xUTavtza7rzUUfWcrMg2/
RSA 2063
|
74 |
|
SHA256:4yJT6ETLN6Jcri9WTGgIf
RSA 2048
|
60 |
SSH server software
Server identification strings seen on the most distinct IPs
| software | IPs |
|---|---|
| OpenSSH_9.6p1 Ubuntu-3ubuntu13.19 | 4,830 |
| OpenSSH_8.9p1 Ubuntu-3ubuntu0.17 | 2,260 |
| OpenSSH_7.4 | 1,550 |
| OpenSSH_8.0 | 1,012 |
| OpenSSH_9.2p1 Debian-2+deb12u10 | 969 |
| OpenSSH_7.9p1 Raspbian-10+deb10u4 | 924 |
| OpenSSH_8.2p1 Ubuntu-4ubuntu0.13 | 923 |
| OpenSSH_10.0p2 Debian-7+deb13u4 | 809 |
| OpenSSH_7.9p1 Raspbian-10+deb10u2+rpt1 | 769 |
| OpenSSH_9.9 | 714 |
Self-signed vs CA-issued
Validity
TLS version negotiated
About this data
sslsnitch continuously connects to every routable IPv4 address on the standard TLS web, mail and SSH ports, records the certificate chain or SSH host keys each server presents, and disconnects. No application data is sent, no login is attempted, and nothing beyond the public key material is stored. Read more on the scanner page.
A certificate is one distinct X.509 certificate identified by its SHA-256 fingerprint. An SSH host key is one distinct host key or OpenSSH host certificate, also identified by its SHA-256 fingerprint. An endpoint is one IP address and port combination. An observation is one occasion on which an endpoint presented a certificate or host key. The top-10 lists exclude certificate authority certificates so that intermediates and roots do not crowd out the leaf certificates that servers actually deploy. Visitors see IP addresses with the last octet hidden and SSH host key fingerprints with their second half hidden. Signed-in users with an active access pass see full addresses, and every IP, certificate, SSH host key, issuer, organisation, name, key algorithm and SSH server software on this page links to the matching search or detail page.
Figures are recomputed daily from the full index. Want to search the underlying data by hostname, organisation, issuer, fingerprint, IP or CIDR? Get an access pass.