Certificate authority · Snapshot 23 October 2026
Sites on Amazon
3,666 measured sites rely on Amazon as their certificate authority. How common it is by popularity band, how its customers configure related checks, and the continuity steps worth taking.
- Sites
- 3,666
- Median readiness index
- 64/100
- Profiles
- 1,903
9.1% of all measured sites
all sites: 64
top-50K sites
Share by popularity band
| Chrome UX Report band | Share of measured sites | Sites |
|---|---|---|
| Top 1K | 11% | 51 |
| Top 5K | 11% | 235 |
| Top 10K | 12% | 309 |
| Top 50K | 10% | 1,910 |
| Top 100K | 9.8% | 516 |
| Top 500K | 7.8% | 417 |
| Top 1M | 4.1% | 228 |
Related checks among Amazon customers
| Check | Lane | Observed | All sites | Measured |
|---|---|---|---|---|
| Certificate lifetime of 100 days or less | Harden | <1% | 67% | 3,666 |
| Certificate has more than 14 days left | Harden | >99% | 99% | 3,666 |
| CAA records limit who can issue certificates | Harden | 9.9% | 13% | 3,662 |
| TLS 1.3 negotiated | Harden | 88% | 91% | 3,666 |
| HSTS kept for at least a year | Harden | 45% | 34% | 3,047 |
Continuity steps for Amazon customers
- Automate renewal with ACME. Public TLS certificates are limited to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029.
- If you publish CAA records, include a second certificate authority you could switch to, so one issuer's problem cannot block renewal.
- Keep a list of where each certificate is installed (CDN, load balancer, origin) and how each one renews.
CA/Browser Forum ballot SC-081v3Let's Encrypt: CAAService guide: AWS (Amazon Web Services)