Which certificate authorities sites actually use
Every TLS handshake this scanner performs records who issued the certificate. This is that tally: what it shows, and what it does not.
The numbers
Measured across 3 certificates seen by this scanner. One row per issuing organisation, as named in the certificate's issuer field.
| Certificate authority | Certificates seen | Share |
|---|---|---|
| Google Trust Services | 1 | 33.3% |
| Let's Encrypt | 1 | 33.3% |
| Amazon | 1 | 33.3% |
What this measures, and what it does not
This is a tally of the sites people have chosen to scan here, which is not the same as a sample of the web. People scan their own sites, sites they are about to trust, and sites they suspect something about, so the mix is skewed towards small and medium sites and away from the long tail of parked domains. Treat it as a view of one scanner's traffic, not as market share.
Two further limits are worth stating. The issuer name comes from the certificate itself, and one authority can appear under several names as it rotates intermediates, so closely related rows may describe the same organisation. And a site behind a CDN usually presents the CDN's certificate rather than one the site owner chose, which moves the credit to whoever terminates TLS.
No hostname is stored against any of these counts. Publishing which sites use which authority would be an archive of third-party scan results, which is precisely what the reports on this site deliberately are not: They are unlisted, noindexed and expire. The counter increments and nothing else is written.
Why the issuer matters at all
A certificate authority is the party a browser trusts to confirm that whoever presents a certificate for a domain actually controls it. Every browser ships a root store, and any authority in it can issue for any name, which is why the list of trusted roots is short and heavily audited, and why authorities that misissue are removed from it. That has happened several times, and each time every certificate from that authority stopped being trusted, sometimes with weeks of notice.
For most sites the practical differences between authorities are small: Validation level, issuance limits, how long a certificate lasts, and whether issuance can be automated. The one that matters operationally is automation, because a certificate that is renewed by a person is a certificate that eventually expires on a weekend.
If you want to control which authorities may issue for your domain, publish a CAA record. It is a single DNS entry, it is checked by every public CA at issuance time, and it turns "any of the hundred-odd trusted roots" into "these two". The CAA check explains it, and the email and DNS checker reports whether you have one.
Expiry is the failure mode
Almost every certificate incident that takes a site down is an expiry, not a compromise. The fix is automation: ACME clients renew on a schedule and the certificate never approaches its end date. Where automation is not possible, a reminder is the fallback, and the SSL checker offers one: Scan a site and you can ask to be told a week before its certificate expires, with a confirmation step and an unsubscribe link in every message.