Certificate authority · Snapshot 23 October 2026
Sites on Let's Encrypt
12,265 measured sites rely on Let's Encrypt as their certificate authority. How common it is by popularity band, how its customers configure related checks, and the continuity steps worth taking.
- Sites
- 12,265
- Median readiness index
- 65/100
- Profiles
- 4,023
31% of all measured sites
all sites: 64
top-50K sites
Share by popularity band
| Chrome UX Report band | Share of measured sites | Sites |
|---|---|---|
| Top 1K | 15% | 69 |
| Top 5K | 20% | 418 |
| Top 10K | 22% | 556 |
| Top 50K | 26% | 4,882 |
| Top 100K | 29% | 1,510 |
| Top 500K | 36% | 1,915 |
| Top 1M | 52% | 2,915 |
Related checks among Let's Encrypt customers
| Check | Lane | Observed | All sites | Measured |
|---|---|---|---|---|
| Certificate lifetime of 100 days or less | Harden | 100% | 67% | 12,265 |
| Certificate has more than 14 days left | Harden | >99% | 99% | 12,265 |
| CAA records limit who can issue certificates | Harden | 13% | 13% | 12,254 |
| TLS 1.3 negotiated | Harden | 92% | 91% | 12,265 |
| HSTS kept for at least a year | Harden | 28% | 34% | 10,037 |
Continuity steps for Let's Encrypt customers
- Automate renewal with ACME. Public TLS certificates are limited to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029.
- If you publish CAA records, include a second certificate authority you could switch to, so one issuer's problem cannot block renewal.
- Keep a list of where each certificate is installed (CDN, load balancer, origin) and how each one renews.