How long are the TLS certificates of the top 1000 websites?

Latest scan: Scanned 2026-10-26, 12:07–12:09 UTC · Tranco list 262N9 · one TLS handshake per site, nothing else

From 2027-03-15, certificate authorities may only issue TLS certificates valid for at most 100 days. We connected once to each of the Tranco top 1000 domains and read the certificate it sent. 735 answered with a publicly trusted certificate for their own name. Of those, 56.2% (413) are valid for longer than 100 days, and 99.3% (730) for longer than 47 days.

Since last scan (initial scans 48 hours apart)

Honest history note: Unlike Qualys SSL Pulse which has years of real monthly history, this survey is newly launched. The initial two scans were run 48 hours apart (2026-10-24 and 2026-10-26) during launch setup; regular weekly rescans follow thereafter (next scan due after 2026-11-02). The +0.1 pts change between the first two scans represents a difference of exactly one certificate (413 vs 412 over 100 days) across 48 hours, not a multi-week trend. As weekly scans accumulate, this table builds a multi-month trend comparable to Qualys SSL Pulse. One row per scan of the same 1000 domains, newest first. Every figure is computed from that scan's own snapshot; no figure is interpolated or estimated. Change is against the scan in the row below. The issuer columns are the median validity of the 5 organisations that issued the most trusted certificates in the latest scan. As a table: trend.json.

Validity period of 735 trusted certificates

What the 100-day cap means

The rule comes from CA/Browser Forum ballot SC-081v3, which browsers and certificate authorities agreed on. It shortens the longest certificate a public CA may issue in steps: 200 days for certificates issued from 2026-03-15, 100 days for certificates issued from 2027-03-15, 47 days for certificates issued from 2029-03-15.

• Nothing breaks on 2027-03-15. A certificate issued before that date stays valid until its own expiry date. The cap applies to new certificates and renewals.
• The next renewal is the one that changes. The 413 sites whose certificate runs longer than 100 days will get at most 100 days from the first renewal after 2027-03-15, so a renewal done by hand once a year no longer works.
• The certificates over 200 days were issued before 2026-03-15, when the limit was higher; nothing longer can be issued now.
• 47 days from 2029-03-15 leaves room for roughly monthly renewals, which in practice means automated renewal (ACME or the CA's own agent) and a check that the new certificate was actually deployed.

Who issued them

Grouped by the Organization field of the issuing CA certificate as each server sent it, with spellings of one company (such as "Inc" with or without a comma) counted together: 25 organisations.

Expiring within 14 days of the scan

19 trusted certificates had 14 days or less left. For large sites this is usually planned: they renew short certificates a few days before expiry. It is a list of dates, not of mistakes.

Domains without a usable certificate

236 of 1000 domains (23.6%) sent no certificate on port 443, and 29 sent one that is expired, untrusted or for another name. Most are not websites: the Tranco list ranks domains by how often they are looked up or visited, so it includes CDN, DNS and API names that never serve HTTPS on the bare name. They are left out of the percentages above.

• Certificate expired: 4
• Connection or TLS handshake failed or timed out: 41
• Name has no address (neither it nor www.): 190
• Resolves to a private or local address, so the check refuses to connect: 5
• Certificate not publicly trusted: 25

Method

• Sites: the first 1000 entries of Tranco list 262N9 (generated 2026-10-23 from rankings of 2026-09-24 to 2026-10-23).
• Check: the same guarded TLS handshake as the free single check: the name must resolve to a public address, then one connection to port 443 with the name sent as SNI, at most 10 sites at a time and a 5.0 s timeout. No Certificate Transparency and no registry (RDAP) lookups.
• www.: if the bare domain did not send a trusted certificate for its own name, we tried www.<domain> once and kept the better answer; 42 of the trusted certificates were measured that way. Each row below names the host actually measured.
• Validity is notAfter minus notBefore as written in the certificate, plus one second because the notAfter second itself is still valid, so a certificate sold as N days counts as exactly N. "Longer than 100 days" means strictly more than 100.
• Trusted means the chain verified against this server's system root store and the certificate names the host.
• The scan took 146 s. Every total on this page is computed from the per-host rows, which you can download as JSON.

Limits

• Measured from one server on a home connection, single pass, IPv4 preferred. Large sites serve different certificates by region, IP and client; another location could see a different certificate.
• Validity says how long a certificate could be used, not how often the site renews. Some sites replace long certificates early.
• The top 1000 domains are not typical websites: they are big, mostly automated operations. Smaller sites with manual renewals are the ones the cap affects most, and they are not in this sample.
• This report covers certificate lifetime and issuer only. Qualys SSL Pulse covers protocol and cipher support across a larger set of sites.

Check your own

The free tools use the same handshake, need no login and store nothing.

All 1000 hosts