tls feature support

June 2016 scan results

Sorry, no analysis this month.

SSL/TLS survey of 593851 websites from Alexa's top 1 million
Stats only from connections that did provide valid certificates
(or anonymous DH from servers that do also have valid certificate installed)


Supported Ciphers         Count     Percent
-------------------------+---------+-------
3DES                      525961    88.5678
3DES Only                 605       0.1019
3DES Preferred            1797      0.3026
3DES forced in TLS1.1+    978       0.1647
AES                       589255    99.2261
AES Only                  43606     7.3429
AES-CBC                   588687    99.1304
AES-CBC Only              5565      0.9371
AES-GCM                   490658    82.6231
AES-GCM Only              520       0.0876
CAMELLIA                  261701    44.0685
CAMELLIA Only             2         0.0003
CHACHA20                  81256     13.6829
Insecure                  56141     9.4537
RC4                       166167    27.9813
RC4 Only                  158       0.0266
RC4 Preferred             13843     2.3311
RC4 forced in TLS1.1+     7176      1.2084
x:FF 29 3DES Only         654       0.1101
x:FF 29 3DES Preferred    2164      0.3644
x:FF 29 RC4 Only          233       0.0392
x:FF 29 RC4 Preferred     16139     2.7177
x:FF 29 incompatible      518       0.0872
x:FF 35 3DES Only         662       0.1115
x:FF 35 3DES Preferred    2094      0.3526
x:FF 35 RC4 Only          273       0.046
x:FF 35 RC4 Preferred     16162     2.7216
x:FF 35 incompatible      522       0.0879
x:FF 44 3DES Only         4368      0.7355
x:FF 44 3DES Preferred    8162      1.3744
x:FF 44 incompatible      795       0.1339
y:DHE-RSA-SEED-SHA        79533     13.3928
y:IDEA-CBC-SHA            76113     12.8169
y:SEED-SHA                90128     15.1769
z:ADH-AES128-GCM-SHA256   430       0.0724
z:ADH-AES128-SHA          771       0.1298
z:ADH-AES128-SHA256       268       0.0451
z:ADH-AES256-GCM-SHA384   444       0.0748
z:ADH-AES256-SHA          809       0.1362
z:ADH-AES256-SHA256       269       0.0453
z:ADH-CAMELLIA128-SHA     401       0.0675
z:ADH-CAMELLIA128-SHA256  1         0.0002
z:ADH-CAMELLIA256-SHA     424       0.0714
z:ADH-CAMELLIA256-SHA256  1         0.0002
z:ADH-DES-CBC-SHA         326       0.0549
z:ADH-DES-CBC3-SHA        781       0.1315
z:ADH-RC4-MD5             571       0.0962
z:ADH-SEED-SHA            322       0.0542
z:AECDH-AES128-SHA        10202     1.7179
z:AECDH-AES256-SHA        10261     1.7279
z:AECDH-DES-CBC3-SHA      10168     1.7122
z:AECDH-NULL-SHA          94        0.0158
z:AECDH-RC4-SHA           9605      1.6174
z:DES-CBC-MD5             6658      1.1212
z:DES-CBC-SHA             35044     5.9011
z:DES-CBC3-MD5            17074     2.8751
z:ECDHE-RSA-NULL-SHA      100       0.0168
z:EDH-RSA-DES-CBC-SHA     29995     5.0509
z:EXP-ADH-DES-CBC-SHA     181       0.0305
z:EXP-ADH-RC4-MD5         180       0.0303
z:EXP-DES-CBC-SHA         10901     1.8356
z:EXP-EDH-RSA-DES-CBC-SHA 8667      1.4595
z:EXP-RC2-CBC-MD5         13108     2.2073
z:EXP-RC4-MD5             13716     2.3097
z:EXP1024-DES-CBC-SHA     3463      0.5831
z:EXP1024-RC4-SHA         3524      0.5934
z:IDEA-CBC-MD5            1453      0.2447
z:NULL-MD5                233       0.0392
z:NULL-SHA                238       0.0401
z:NULL-SHA256             36        0.0061
z:RC2-CBC-MD5             6966      1.173
z:RC4-64-MD5              757       0.1275

Cipher ordering           Count     Percent
-------------------------+---------+-------
Client side               152565    25.6908
Server side               441286    74.3092

Supported Handshakes      Count     Percent
-------------------------+---------+-------
ADH                       979       0.1649
AECDH                     10271     1.7296
DHE                       320930    54.0422
ECDH                      2         0.0003
ECDHE                     517887    87.2082
ECDHE and DHE             274945    46.2987
RSA                       509769    85.8412

Supported PFS             Count     Percent  PFS Percent
-------------------------+---------+--------+-----------
DH,1024bits               119481    20.1197  37.2296
DH,1028bits               1         0.0002   0.0003
DH,2048bits               188192    31.6901  58.6396
DH,2236bits               78        0.0131   0.0243
DH,2430bits               1         0.0002   0.0003
DH,2432bits               3         0.0005   0.0009
DH,2560bits               1         0.0002   0.0003
DH,3072bits               132       0.0222   0.0411
DH,3092bits               2         0.0003   0.0006
DH,3196bits               1         0.0002   0.0003
DH,4046bits               1         0.0002   0.0003
DH,4094bits               1         0.0002   0.0003
DH,4096bits               12637     2.128    3.9376
DH,512bits                108       0.0182   0.0337
DH,6144bits               1         0.0002   0.0003
DH,768bits                385       0.0648   0.12
DH,8192bits               8         0.0013   0.0025
ECDH,B-571,570bits        3072      0.5173   0.5932
ECDH,K-163,163bits        1         0.0002   0.0002
ECDH,P-192,192bits        60        0.0101   0.0116
ECDH,P-224,224bits        94        0.0158   0.0182
ECDH,P-256,256bits        490672    82.6254  94.745
ECDH,P-384,384bits        9474      1.5953   1.8294
ECDH,P-521,521bits        16461     2.7719   3.1785
ECDH,brainpoolP512r1,512bits 1         0.0002   0.0002
ECDH,secp256k1,256bits    1         0.0002   0.0002
Prefer DH,1024bits        45380     7.6416   14.1402
Prefer DH,2048bits        5635      0.9489   1.7558
Prefer DH,3072bits        8         0.0013   0.0025
Prefer DH,3092bits        2         0.0003   0.0006
Prefer DH,4096bits        398       0.067    0.124
Prefer DH,768bits         44        0.0074   0.0137
Prefer ECDH,B-571,570bits 2840      0.4782   0.5484
Prefer ECDH,K-163,163bits 1         0.0002   0.0002
Prefer ECDH,P-192,192bits 1         0.0002   0.0002
Prefer ECDH,P-224,224bits 92        0.0155   0.0178
Prefer ECDH,P-256,256bits 453139    76.3052  87.4977
Prefer ECDH,P-384,384bits 7350      1.2377   1.4192
Prefer ECDH,P-521,521bits 15215     2.5621   2.9379
Prefer ECDH,brainpoolP512r1,512bits 1         0.0002   0.0002
Prefer ECDH,secp256k1,256bits 1         0.0002   0.0002
Prefer PFS                530107    89.266   0
Support PFS               563872    94.9518  0

Supported ECC curves      Count     Percent 
-------------------------+---------+--------
brainpoolP256r1           17814     2.9997   
brainpoolP384r1           17827     3.0019   
brainpoolP512r1           17836     3.0034   
prime192v1                1799      0.3029   
prime256v1                513258    86.4288  
prime256v1 Only           427959    72.065   
secp160k1                 1678      0.2826   
secp160r1                 1688      0.2842   
secp160r2                 1678      0.2826   
secp192k1                 1693      0.2851   
secp224k1                 1780      0.2997   
secp224r1                 5748      0.9679   
secp256k1                 20085     3.3822   
secp384r1                 88954     14.9792  
secp384r1 Only            3672      0.6183   
secp521r1                 50953     8.5801   
secp521r1 Only            140       0.0236   
sect163k1                 1684      0.2836   
sect163k1 Only            2         0.0003   
sect163r1                 1682      0.2832   
sect163r2                 1681      0.2831   
sect193r1                 1681      0.2831   
sect193r2                 1681      0.2831   
sect233k1                 1770      0.2981   
sect233r1                 1768      0.2977   
sect239k1                 1768      0.2977   
sect283k1                 19394     3.2658   
sect283r1                 19392     3.2655   
sect409k1                 19395     3.266    
sect409r1                 19391     3.2653   
sect571k1                 19395     3.266    
sect571r1                 19395     3.266    

Unsupported curve fallback     Count     Percent 
------------------------------+---------+--------
False                          56371     9.4924   
True                           391090    65.8566  
order-specific                 45        0.0076   
unknown                        146345    24.6434  

ECC curve ordering        Count     Percent 
-------------------------+---------+--------
client                    13249     2.231    
inconclusive-noecc        8         0.0013   
server                    503853    84.845   
unknown                   76741     12.9226  

TLSv1.2 PFS supported sigalgs  Count     Percent 
------------------------------+---------+--------
ECDSA-SHA1                     53286     8.973    
ECDSA-SHA1 Only                8         0.0013   
ECDSA-SHA224                   53248     8.9666   
ECDSA-SHA256                   71063     11.9665  
ECDSA-SHA384                   71064     11.9666  
ECDSA-SHA512                   71074     11.9683  
ECDSA-SHA512 Only              16        0.0027   
RSA-MD5                        27142     4.5705   
RSA-SHA1                       447072    75.2835  
RSA-SHA1 Only                  34046     5.7331   
RSA-SHA224                     371135    62.4963  
RSA-SHA256                     422358    71.1219  
RSA-SHA256 Only                8044      1.3545   
RSA-SHA384                     383992    64.6613  
RSA-SHA384 Only                4         0.0007   
RSA-SHA512                     384022    64.6664  
RSA-SHA512 Only                209       0.0352   

TLSv1.2 PFS ordering           Count     Percent 
------------------------------+---------+--------
client                         280809    47.2861  
indeterminate                  54        0.0091   
intolerant                     6465      1.0887   
order-fallback                 8         0.0013   
server                         220388    37.1117  
unsupported                    15018     2.5289   

TLSv1.2 PFS sigalg fallback    Count     Percent 
------------------------------+---------+--------
ECDSA SHA1                     53230     8.9635   
ECDSA intolerant               189       0.0318   
ECDSA pfs-rsa-SHA512           17719     2.9837   
ECDSA soft-nopfs               7         0.0012   
RSA False                      26845     4.5205   
RSA SHA1                       386610    65.1022  
RSA intolerant                 43313     7.2936   
RSA pfs-ecdsa-SHA512           27        0.0045   
RSA soft-nopfs                 474       0.0798   

Renegotiation             Count     Percent 
-------------------------+---------+--------
False                     4962      0.8356   
insecure                  16550     2.7869   
secure                    572339    96.3775  

Compression               Count     Percent 
-------------------------+---------+--------
1 (zlib compression)      7077      1.1917   
False                     4962      0.8356   
NONE                      581812    97.9727  

TLS session ticket hint   Count     Percent 
-------------------------+---------+--------
1                         2         0.0003   
1 only                    2         0.0003   
2                         1         0.0002   
2 only                    1         0.0002   
5                         5         0.0008   
5 only                    5         0.0008   
10                        8         0.0013   
10 only                   8         0.0013   
15                        8         0.0013   
15 only                   8         0.0013   
30                        25        0.0042   
30 only                   25        0.0042   
60                        166       0.028    
60 only                   161       0.0271   
65                        2         0.0003   
65 only                   2         0.0003   
70                        8         0.0013   
70 only                   8         0.0013   
75                        1         0.0002   
75 only                   1         0.0002   
90                        1         0.0002   
90 only                   1         0.0002   
100                       16        0.0027   
100 only                  16        0.0027   
120                       27        0.0045   
120 only                  27        0.0045   
128                       6         0.001    
128 only                  6         0.001    
150                       2         0.0003   
180                       78        0.0131   
180 only                  74        0.0125   
240                       14        0.0024   
240 only                  14        0.0024   
244                       2         0.0003   
244 only                  2         0.0003   
300                       298609    50.2835  
300 only                  295255    49.7187  
302                       2         0.0003   
302 only                  2         0.0003   
360                       3         0.0005   
360 only                  2         0.0003   
400                       6         0.001    
400 only                  6         0.001    
420                       129       0.0217   
420 only                  111       0.0187   
450                       1         0.0002   
450 only                  1         0.0002   
480                       11        0.0019   
480 only                  11        0.0019   
500                       3         0.0005   
500 only                  3         0.0005   
540                       4         0.0007   
540 only                  4         0.0007   
600                       28678     4.8292   
600 only                  28547     4.8071   
660                       1         0.0002   
660 only                  1         0.0002   
700                       1         0.0002   
700 only                  1         0.0002   
720                       3         0.0005   
720 only                  3         0.0005   
840                       2         0.0003   
840 only                  2         0.0003   
900                       1532      0.258    
900 only                  1515      0.2551   
960                       3         0.0005   
960 only                  3         0.0005   
1000                      1         0.0002   
1000 only                 1         0.0002   
1200                      3512      0.5914   
1200 only                 3508      0.5907   
1210                      2         0.0003   
1210 only                 2         0.0003   
1320                      1         0.0002   
1320 only                 1         0.0002   
1380                      1         0.0002   
1380 only                 1         0.0002   
1440                      1         0.0002   
1440 only                 1         0.0002   
1500                      6         0.001    
1500 only                 5         0.0008   
1800                      751       0.1265   
1800 only                 734       0.1236   
1980                      2         0.0003   
1980 only                 2         0.0003   
2100                      2         0.0003   
2100 only                 1         0.0002   
2400                      10        0.0017   
2400 only                 10        0.0017   
2700                      11        0.0019   
2700 only                 11        0.0019   
3000                      42        0.0071   
3000 only                 42        0.0071   
3300                      1         0.0002   
3300 only                 1         0.0002   
3600                      1079      0.1817   
3600 only                 1070      0.1802   
3900                      1         0.0002   
3900 only                 1         0.0002   
4200                      1         0.0002   
4500                      1         0.0002   
4500 only                 1         0.0002   
5160                      1         0.0002   
5160 only                 1         0.0002   
5400                      19        0.0032   
5400 only                 6         0.001    
6000                      352       0.0593   
6000 only                 352       0.0593   
7200                      15154     2.5518   
7200 only                 15130     2.5478   
9000                      2         0.0003   
9000 only                 2         0.0003   
10800                     5334      0.8982   
10800 only                5324      0.8965   
14400                     116       0.0195   
14400 only                116       0.0195   
18000                     9         0.0015   
18000 only                9         0.0015   
21600                     4287      0.7219   
21600 only                4286      0.7217   
25200                     1         0.0002   
25200 only                1         0.0002   
28800                     2555      0.4302   
28800 only                2555      0.4302   
30000                     3         0.0005   
30000 only                1         0.0002   
36000                     1220      0.2054   
36000 only                1209      0.2036   
43200                     65        0.0109   
43200 only                65        0.0109   
54000                     1         0.0002   
54000 only                1         0.0002   
54647                     1         0.0002   
54660                     1         0.0002   
54674                     1         0.0002   
54690                     1         0.0002   
54703                     1         0.0002   
54722                     1         0.0002   
54737                     1         0.0002   
54751                     1         0.0002   
60000                     2         0.0003   
60000 only                2         0.0003   
64800                     70759     11.9153  
64800 only                70736     11.9114  
72000                     12        0.002    
72000 only                12        0.002    
79200                     1         0.0002   
79200 only                1         0.0002   
86400                     2990      0.5035   
86400 only                2984      0.5025   
100800                    9026      1.5199   
100800 only               9015      1.5181   
108000                    1         0.0002   
108000 only               1         0.0002   
115200                    1         0.0002   
115200 only               1         0.0002   
129600                    6         0.001    
129600 only               6         0.001    
172800                    47        0.0079   
172800 only               47        0.0079   
216000                    4         0.0007   
216000 only               3         0.0005   
259200                    2         0.0003   
259200 only               2         0.0003   
432000                    1         0.0002   
432000 only               1         0.0002   
604800                    1         0.0002   
604800 only               1         0.0002   
864000                    2         0.0003   
864000 only               2         0.0003   
7776000                   1         0.0002   
7776000 only              1         0.0002   
None                      150742    25.3838  
None only                 147105    24.7714  

Certificate sig alg     Count     Percent 
-------------------------+---------+--------
None                      10920     1.8388   
ecdsa-with-SHA256         68463     11.5286  
sha1WithRSAEncryption     21372     3.5989   
sha256WithRSAEncryption   521742    87.8574  
sha384WithRSAEncryption   8         0.0013   
sha512WithRSAEncryption   69        0.0116   

Certificate key size    Count     Percent 
-------------------------+---------+--------
ECDSA 256                 71108     11.974   
ECDSA 384                 38        0.0064   
ECDSA 521                 1         0.0002   
RSA 1024                  15        0.0025   
RSA 2048                  511834    86.189   
RSA 2049                  3         0.0005   
RSA 2056                  1         0.0002   
RSA 2058                  3         0.0005   
RSA 2059                  1         0.0002   
RSA 2080                  6         0.001    
RSA 2084                  2         0.0003   
RSA 2086                  1         0.0002   
RSA 2096                  3         0.0005   
RSA 2408                  1         0.0002   
RSA 2432                  3         0.0005   
RSA 2560                  1         0.0002   
RSA 2948                  1         0.0002   
RSA 3072                  163       0.0274   
RSA 3073                  1         0.0002   
RSA 3096                  2         0.0003   
RSA 3248                  3         0.0005   
RSA 4048                  4         0.0007   
RSA 4056                  18        0.003    
RSA 4069                  1         0.0002   
RSA 4086                  4         0.0007   
RSA 4092                  2         0.0003   
RSA 4094                  1         0.0002   
RSA 4095                  1         0.0002   
RSA 4096                  30991     5.2186   
RSA 4196                  1         0.0002   
RSA 8192                  10        0.0017   
RSA 8392                  1         0.0002   
RSA/ECDSA Dual Stack      20358     3.4281

OCSP stapling             Count     Percent 
-------------------------+---------+--------
Supported                 126688    21.3333  
Unsupported               467163    78.6667  

Supported Protocols       Count     Percent
-------------------------+---------+-------
SSL2                      17236     2.9024
SSL2 Only                 12        0.002
SSL3                      99629     16.7768
SSL3 Only                 497       0.0837
SSL3 or TLS1 Only         52946     8.9157
SSL3 or lower Only        505       0.085
TLS1                      582034    98.0101
TLS1 Only                 32797     5.5228
TLS1 or lower Only        68913     11.6044
TLS1.1                    515189    86.7539
TLS1.1 Only               42        0.0071
TLS1.1 or up Only         11134     1.8749
TLS1.2                    522729    88.0236
TLS1.2 Only               3290      0.554
TLS1.2, 1.0 but not 1.1   5865      0.9876





Statistics from 628845 chains provided by 728648 hosts

Server provided chains    Count     Percent
-------------------------+---------+-------
complete                  570337    78.2733
incomplete                21286     2.9213
untrusted                 137025    18.8054

Trusted chain statistics
========================

Chain length              Count     Percent
-------------------------+---------+-------
2                         1         0.0002
3                         625155    99.4132
4                         3676      0.5846
5                         13        0.0021

CA key size in chains     Count
-------------------------+---------
ECDSA 256                 68458     
ECDSA 384                 68457     
RSA 1024                  8         
RSA 2045                  2         
RSA 2048                  927971    
RSA 4096                  196495    

Chains with CA key        Count     Percent
-------------------------+---------+-------
ECDSA 256                 68458     10.8863
ECDSA 384                 68456     10.886
RSA 1024                  6         0.001
RSA 2045                  2         0.0003
RSA 2048                  559959    89.0456
RSA 4096                  195838    31.1425

Signature algorithm (ex. root) Count
------------------------------+---------
ecdsa-with-SHA384              68447     
sha1WithRSAEncryption          24541     
sha256WithRSAEncryption        363378    
sha384WithRSAEncryption        176120    
sha512WithRSAEncryption        60        

Eff. host cert chain LoS  Count     Percent
-------------------------+---------+-------
80                        24524     3.8998
112                       535845    85.211
128                       68476     10.8892

Most popular root CAs                         Count     Percent
---------------------------------------------+---------+-------
(d6325660) COMODO RSA Certification Authority 158376    25.1852
(2c543cd1) GeoTrust Global CA                 95542     15.1933
(eed8c118) COMODO ECC Certification Authority 68438     10.8831
(cbf06781) Go Daddy Root Certificate Authorit 49514     7.8738
(5ad8a5d6) GlobalSign Root CA                 48382     7.6938
(b204d74a) VeriSign Class 3 Public Primary Ce 32086     5.1024
(2e5ac55d) DST Root CA X3                     26043     4.1414
(244b5494) DigiCert High Assurance EV Root CA 20408     3.2453
(2e4eed3c) thawte Primary Root CA             19033     3.0267
(fc5a8f99) USERTrust RSA Certification Author 17598     2.7985
(653b494a) Baltimore CyberTrust Root          11671     1.8559
(3513523f) DigiCert Global Root CA            10585     1.6832
(ae8153b9) StartCom Certification Authority   9453      1.5032
(4bfab552) Starfield Root Certificate Authori 8502      1.352


Scan performed between 19th of June and 6th of July 2016

February 2016 scan results (incomplete)

Unfortunately during scanning the disk space on the server run out so the results are not complete.

Other than that, no interesting developments, just continuation of established trends.

SSL/TLS survey of 479178 websites from Alexa's top 1 million
Stats only from connections that did provide valid certificates
(or anonymous DH from servers that do also have valid certificate installed)


Supported Ciphers         Count     Percent
-------------------------+---------+-------
3DES                      419340    87.5124
3DES Only                 506       0.1056
3DES Preferred            1692      0.3531
3DES forced in TLS1.1+    922       0.1924
AES                       474652    99.0555
AES Only                  37306     7.7854
AES-CBC                   474138    98.9482
AES-CBC Only              7523      1.57
AES-GCM                   380917    79.4938
AES-GCM Only              466       0.0972
CAMELLIA                  201933    42.1415
CAMELLIA Only             3         0.0006
CHACHA20                  66326     13.8416
CHACHA20 Only             1         0.0002
Insecure                  48383     10.0971
RC4                       149250    31.1471
RC4 Only                  177       0.0369
RC4 Preferred             15506     3.236
RC4 forced in TLS1.1+     8442      1.7618
x:FF 29 3DES Only         550       0.1148
x:FF 29 3DES Preferred    2012      0.4199
x:FF 29 RC4 Only          265       0.0553
x:FF 29 RC4 Preferred     17097     3.568
x:FF 29 incompatible      321       0.067
x:FF 35 3DES Only         559       0.1167
x:FF 35 3DES Preferred    1924      0.4015
x:FF 35 RC4 Only          311       0.0649
x:FF 35 RC4 Preferred     17124     3.5736
x:FF 35 incompatible      325       0.0678
y:DHE-RSA-SEED-SHA        60590     12.6446
y:IDEA-CBC-SHA            58075     12.1197
y:SEED-SHA                70022     14.6129
z:ADH-AES128-GCM-SHA256   354       0.0739
z:ADH-AES128-SHA          605       0.1263
z:ADH-AES128-SHA256       246       0.0513
z:ADH-AES256-GCM-SHA384   367       0.0766
z:ADH-AES256-SHA          618       0.129
z:ADH-AES256-SHA256       245       0.0511
z:ADH-CAMELLIA128-SHA     316       0.0659
z:ADH-CAMELLIA256-SHA     321       0.067
z:ADH-DES-CBC-SHA         243       0.0507
z:ADH-DES-CBC3-SHA        620       0.1294
z:ADH-RC4-MD5             455       0.095
z:ADH-SEED-SHA            254       0.053
z:AECDH-AES128-SHA        7521      1.5696
z:AECDH-AES256-SHA        7556      1.5769
z:AECDH-DES-CBC3-SHA      7499      1.565
z:AECDH-NULL-SHA          45        0.0094
z:AECDH-RC4-SHA           7010      1.4629
z:DES-CBC-MD5             7605      1.5871
z:DES-CBC-SHA             30728     6.4126
z:DES-CBC3-MD5            17199     3.5893
z:ECDHE-RSA-NULL-SHA      53        0.0111
z:EDH-RSA-DES-CBC-SHA     25945     5.4145
z:EXP-ADH-DES-CBC-SHA     148       0.0309
z:EXP-ADH-RC4-MD5         145       0.0303
z:EXP-DES-CBC-SHA         10647     2.2219
z:EXP-EDH-RSA-DES-CBC-SHA 8346      1.7417
z:EXP-RC2-CBC-MD5         12795     2.6702
z:EXP-RC4-MD5             13391     2.7946
z:EXP1024-DES-CBC-SHA     3415      0.7127
z:EXP1024-RC4-SHA         3465      0.7231
z:IDEA-CBC-MD5            1613      0.3366
z:NULL-MD5                162       0.0338
z:NULL-SHA                169       0.0353
z:NULL-SHA256             38        0.0079
z:RC2-CBC-MD5             7754      1.6182
z:RC4-64-MD5              712       0.1486

Cipher ordering           Count     Percent
-------------------------+---------+-------
Client side               116701    24.3544
Server side               362477    75.6456

Supported Handshakes      Count     Percent
-------------------------+---------+-------
ADH                       753       0.1571
AECDH                     7568      1.5794
DHE                       255330    53.285
ECDH                      2         0.0004
ECDHE                     404645    84.4457
ECDHE and DHE             212045    44.2518
RSA                       411697    85.9173

Supported PFS             Count     Percent  PFS Percent
-------------------------+---------+--------+-----------
DH,1024bits               107150    22.3612  41.9653
DH,1338bits               1         0.0002   0.0004
DH,1536bits               1         0.0002   0.0004
DH,2048bits               139444    29.1007  54.6132
DH,2236bits               57        0.0119   0.0223
DH,2432bits               3         0.0006   0.0012
DH,3072bits               93        0.0194   0.0364
DH,3092bits               1         0.0002   0.0004
DH,4096bits               8367      1.7461   3.2769
DH,512bits                52        0.0109   0.0204
DH,768bits                313       0.0653   0.1226
DH,8192bits               7         0.0015   0.0027
ECDH,B-571,570bits        1786      0.3727   0.4414
ECDH,K-163,163bits        1         0.0002   0.0002
ECDH,P-192,192bits        15        0.0031   0.0037
ECDH,P-224,224bits        84        0.0175   0.0208
ECDH,P-256,256bits        389954    81.3798  96.3694
ECDH,P-384,384bits        4297      0.8967   1.0619
ECDH,P-521,521bits        10105     2.1088   2.4973
Prefer DH,1024bits        41750     8.7128   16.3514
Prefer DH,1536bits        1         0.0002   0.0004
Prefer DH,2048bits        4670      0.9746   1.829
Prefer DH,3072bits        7         0.0015   0.0027
Prefer DH,4096bits        333       0.0695   0.1304
Prefer DH,768bits         37        0.0077   0.0145
Prefer ECDH,B-571,570bits 1575      0.3287   0.3892
Prefer ECDH,K-163,163bits 1         0.0002   0.0002
Prefer ECDH,P-224,224bits 81        0.0169   0.02
Prefer ECDH,P-256,256bits 357787    74.6668  88.42
Prefer ECDH,P-384,384bits 3158      0.659    0.7804
Prefer ECDH,P-521,521bits 9166      1.9129   2.2652
Prefer PFS                418566    87.3508  0
Support PFS               447930    93.4788  0

Supported ECC curves      Count     Percent 
-------------------------+---------+--------
brainpoolP256r1           5523      1.1526   
brainpoolP384r1           5524      1.1528   
brainpoolP512r1           5525      1.153    
prime192v1                1353      0.2824   
prime256v1                401476    83.7843  
prime256v1 Only           345957    72.198   
secp160k1                 1299      0.2711   
secp160r1                 1304      0.2721   
secp160r2                 1299      0.2711   
secp192k1                 1314      0.2742   
secp224k1                 1392      0.2905   
secp224r1                 4371      0.9122   
secp256k1                 7238      1.5105   
secp384r1                 56063     11.6998  
secp384r1 Only            584       0.1219   
secp521r1                 28028     5.8492   
secp521r1 Only            125       0.0261   
sect163k1                 1310      0.2734   
sect163k1 Only            3         0.0006   
sect163r1                 1306      0.2726   
sect163r2                 1307      0.2728   
sect193r1                 1306      0.2726   
sect193r2                 1304      0.2721   
sect233k1                 1387      0.2895   
sect233r1                 1386      0.2892   
sect239k1                 1383      0.2886   
sect283k1                 6795      1.4181   
sect283k1 Only            1         0.0002   
sect283r1                 6792      1.4174   
sect409k1                 6793      1.4176   
sect409r1                 6793      1.4176   
sect571k1                 6797      1.4185   
sect571r1                 6797      1.4185   

Unsupported curve fallback     Count     Percent 
------------------------------+---------+--------
False                          43974     9.177    
True                           304974    63.6452  
order-specific                 61        0.0127   
unknown                        130169    27.1651  

ECC curve ordering        Count     Percent 
-------------------------+---------+--------
client                    6487      1.3538   
inconclusive-noecc        8         0.0017   
server                    395730    82.5852  
unknown                   76953     16.0594  

TLSv1.2 PFS supported sigalgs  Count     Percent 
------------------------------+---------+--------
ECDSA-SHA1                     40044     8.3568   
ECDSA-SHA1 Only                3         0.0006   
ECDSA-SHA224                   40035     8.3549   
ECDSA-SHA256                   54403     11.3534  
ECDSA-SHA384                   54398     11.3524  
ECDSA-SHA512                   54399     11.3526  
ECDSA-SHA512 Only              1         0.0002   
RSA-MD5                        47971     10.0111  
RSA-SHA1                       347530    72.5263  
RSA-SHA1 Only                  36263     7.5678   
RSA-SHA224                     288147    60.1336  
RSA-SHA256                     318675    66.5045  
RSA-SHA256 Only                6467      1.3496   
RSA-SHA384                     290085    60.538   
RSA-SHA384 Only                2         0.0004   
RSA-SHA512                     290093    60.5397  
RSA-SHA512 Only                126       0.0263   

TLSv1.2 PFS ordering           Count     Percent 
------------------------------+---------+--------
client                         215610    44.9958  
indeterminate                  32        0.0067   
intolerant                     4623      0.9648   
order-fallback                 3         0.0006   
server                         175045    36.5303  
unsupported                    17219     3.5934   

TLSv1.2 PFS sigalg fallback    Count     Percent 
------------------------------+---------+--------
ECDSA SHA1                     40031     8.3541   
ECDSA intolerant               47        0.0098   
ECDSA pfs-rsa-SHA512           14337     2.992    
ECDSA soft-nopfs               1         0.0002   
RSA False                      47573     9.928    
RSA SHA1                       274148    57.2121  
RSA intolerant                 34088     7.1138   
RSA pfs-ecdsa-SHA512           4         0.0008   
RSA soft-nopfs                 498       0.1039   

Renegotiation             Count     Percent 
-------------------------+---------+--------
False                     5212      1.0877   
insecure                  15480     3.2305   
secure                    458486    95.6818  

Compression               Count     Percent 
-------------------------+---------+--------
1 (zlib compression)      7370      1.5381   
False                     5212      1.0877   
NONE                      466596    97.3743  

TLS session ticket hint   Count     Percent 
-------------------------+---------+--------
1                         4         0.0008   
1 only                    4         0.0008   
2                         1         0.0002   
2 only                    1         0.0002   
10                        6         0.0013   
10 only                   6         0.0013   
15                        5         0.001    
15 only                   5         0.001    
30                        18        0.0038   
30 only                   17        0.0035   
60                        142       0.0296   
60 only                   138       0.0288   
65                        1         0.0002   
65 only                   1         0.0002   
70                        6         0.0013   
100                       15        0.0031   
100 only                  15        0.0031   
120                       24        0.005    
120 only                  24        0.005    
128                       3         0.0006   
128 only                  3         0.0006   
150                       1         0.0002   
180                       58        0.0121   
180 only                  55        0.0115   
240                       7         0.0015   
240 only                  7         0.0015   
244                       1         0.0002   
244 only                  1         0.0002   
300                       230415    48.0855  
300 only                  226909    47.3538  
302                       2         0.0004   
302 only                  2         0.0004   
360                       3         0.0006   
360 only                  1         0.0002   
400                       7         0.0015   
400 only                  7         0.0015   
420                       116       0.0242   
420 only                  93        0.0194   
480                       10        0.0021   
480 only                  10        0.0021   
500                       4         0.0008   
500 only                  4         0.0008   
540                       2         0.0004   
540 only                  2         0.0004   
600                       23920     4.9919   
600 only                  23758     4.9581   
660                       1         0.0002   
660 only                  1         0.0002   
840                       1         0.0002   
840 only                  1         0.0002   
900                       983       0.2051   
900 only                  962       0.2008   
960                       3         0.0006   
960 only                  3         0.0006   
1000                      1         0.0002   
1000 only                 1         0.0002   
1200                      2630      0.5489   
1200 only                 2627      0.5482   
1320                      1         0.0002   
1320 only                 1         0.0002   
1500                      2         0.0004   
1500 only                 1         0.0002   
1800                      500       0.1043   
1800 only                 491       0.1025   
1980                      2         0.0004   
1980 only                 2         0.0004   
2100                      2         0.0004   
2100 only                 1         0.0002   
2400                      7         0.0015   
2400 only                 7         0.0015   
2700                      10        0.0021   
2700 only                 10        0.0021   
3000                      26        0.0054   
3000 only                 26        0.0054   
3600                      664       0.1386   
3600 only                 655       0.1367   
3900                      1         0.0002   
3900 only                 1         0.0002   
5160                      1         0.0002   
5160 only                 1         0.0002   
5400                      15        0.0031   
5400 only                 8         0.0017   
6000                      214       0.0447   
6000 only                 214       0.0447   
7200                      14927     3.1151   
7200 only                 14908     3.1112   
10800                     3286      0.6858   
10800 only                3277      0.6839   
14400                     93        0.0194   
14400 only                91        0.019    
18000                     9         0.0019   
18000 only                9         0.0019   
21600                     3668      0.7655   
21600 only                3668      0.7655   
25200                     1         0.0002   
25200 only                1         0.0002   
28800                     1854      0.3869   
28800 only                1853      0.3867   
36000                     954       0.1991   
36000 only                945       0.1972   
43200                     39        0.0081   
43200 only                39        0.0081   
60000                     1         0.0002   
60000 only                1         0.0002   
64800                     56248     11.7384  
64800 only                56243     11.7374  
72000                     21        0.0044   
72000 only                21        0.0044   
79200                     1         0.0002   
79200 only                1         0.0002   
86000                     44        0.0092   
86000 only                44        0.0092   
86400                     2743      0.5724   
86400 only                2734      0.5706   
100800                    8629      1.8008   
100800 only               8618      1.7985   
115200                    1         0.0002   
115200 only               1         0.0002   
129600                    7         0.0015   
129600 only               7         0.0015   
172800                    9         0.0019   
172800 only               9         0.0019   
216000                    2         0.0004   
216000 only               2         0.0004   
259200                    2         0.0004   
259200 only               2         0.0004   
432000                    1         0.0002   
432000 only               1         0.0002   
604800                    2         0.0004   
864000                    3         0.0006   
864000 only               3         0.0006   
7776000                   2         0.0004   
7776000 only              2         0.0004   
None                      130619    27.259   
None only                 126799    26.4618  

Certificate sig alg     Count     Percent 
-------------------------+---------+--------
None                      8093      1.6889   
ecdsa-with-SHA256         54346     11.3415  
sha1WithRSAEncryption     32309     6.7426   
sha256WithRSAEncryption   406902    84.9167  
sha384WithRSAEncryption   3         0.0006   
sha512WithRSAEncryption   52        0.0109   

Certificate key size    Count     Percent 
-------------------------+---------+--------
ECDSA 256                 54398     11.3524  
ECDSA 384                 18        0.0038   
ECDSA 521                 1         0.0002   
RSA 1024                  28        0.0058   
RSA 2048                  416954    87.0144  
RSA 2049                  3         0.0006   
RSA 2056                  2         0.0004   
RSA 2058                  2         0.0004   
RSA 2084                  4         0.0008   
RSA 2086                  1         0.0002   
RSA 2096                  2         0.0004   
RSA 2432                  1         0.0002   
RSA 3071                  1         0.0002   
RSA 3072                  118       0.0246   
RSA 3073                  1         0.0002   
RSA 3076                  2         0.0004   
RSA 3096                  2         0.0004   
RSA 3248                  2         0.0004   
RSA 4048                  1         0.0002   
RSA 4056                  17        0.0035   
RSA 4092                  7         0.0015   
RSA 4094                  1         0.0002   
RSA 4096                  22025     4.5964   
RSA 4098                  1         0.0002   
RSA 8192                  4         0.0008   
RSA 8392                  1         0.0002   
RSA/ECDSA Dual Stack      14407     3.0066

OCSP stapling             Count     Percent 
-------------------------+---------+--------
Supported                 112039    23.3815  
Unsupported               367139    76.6185  

Supported Protocols       Count     Percent
-------------------------+---------+-------
SSL2                      17376     3.6262
SSL2 Only                 10        0.0021
SSL3                      93563     19.5257
SSL3 Only                 980       0.2045
SSL3 or TLS1 Only         47829     9.9815
SSL3 or lower Only        992       0.207
TLS1                      472039    98.5102
TLS1 Only                 29199     6.0936
TLS1 or lower Only        63377     13.2262
TLS1.1                    404578    84.4317
TLS1.1 Only               297       0.062
TLS1.1 or up Only         5984      1.2488
TLS1.2                    412518    86.0887
TLS1.2 Only               2158      0.4504
TLS1.2, 1.0 but not 1.1   7981      1.6656



Statistics from 487333 chains provided by 621854 hosts

Server provided chains    Count     Percent
-------------------------+---------+-------
complete                  436283    70.1584
incomplete                20784     3.3423
untrusted                 164787    26.4993

Trusted chain statistics
========================

Chain length              Count     Percent
-------------------------+---------+-------
2                         12        0.0025
3                         485364    99.596
4                         1945      0.3991
5                         12        0.0025

CA key size in chains     Count
-------------------------+---------
ECDSA 256                 42987     
ECDSA 384                 42988     
RSA 1024                  28        
RSA 2045                  2         
RSA 2048                  746942    
RSA 4096                  143676    

Chains with CA key        Count     Percent
-------------------------+---------+-------
ECDSA 256                 42987     8.8209
ECDSA 384                 42988     8.8211
RSA 1024                  26        0.0053
RSA 2045                  2         0.0004
RSA 2048                  443976    91.1032
RSA 4096                  143127    29.3694

Signature algorithm (ex. root) Count
------------------------------+---------
ecdsa-with-SHA384              42983     
sha1WithRSAEncryption          37695     
sha256WithRSAEncryption        279113    
sha384WithRSAEncryption        129437    
sha512WithRSAEncryption        62        

Eff. host cert chain LoS  Count     Percent
-------------------------+---------+-------
80                        37722     7.7405
112                       406613    83.4364
128.0                     42998     8.8231

Root CAs                                      Count     Percent
---------------------------------------------+---------+-------
(d6325660) COMODO RSA Certification Authority 115692    23.7398
(2c543cd1) GeoTrust Global CA                 85975     17.6419
(cbf06781) Go Daddy Root Certificate Authorit 43560     8.9384
(eed8c118) COMODO ECC Certification Authority 42977     8.8188
(5ad8a5d6) GlobalSign Root CA                 41299     8.4745
(b204d74a) VeriSign Class 3 Public Primary Ce 28043     5.7544
(244b5494) DigiCert High Assurance EV Root CA 18414     3.7785
(2e4eed3c) thawte Primary Root CA             17524     3.5959
(fc5a8f99) USERTrust RSA Certification Author 13626     2.796
(653b494a) Baltimore CyberTrust Root          10432     2.1406
(3513523f) DigiCert Global Root CA            8525      1.7493
(ae8153b9) StartCom Certification Authority   7668      1.5735
(4bfab552) Starfield Root Certificate Authori 7663      1.5724
(480720ec) GeoTrust Primary Certification Aut 4978      1.0215

Scan performed between 22nd of February and 16th of March 2016

January 2016 scan results

Another month, no exciting changes.

SSL/TLS survey of 541489 websites from Alexa's top 1 million
Stats only from connections that did provide valid certificates
(or anonymous DH from servers that do also have valid certificate installed)


Supported Ciphers         Count     Percent
-------------------------+---------+-------
3DES                      477135    88.1154
3DES Only                 523       0.0966
3DES Preferred            1744      0.3221
3DES forced in TLS1.1+    945       0.1745
AES                       535585    98.9097
AES Only                  34994     6.4626
AES-CBC                   534935    98.7896
AES-CBC Only              9110      1.6824
AES-GCM                   422759    78.0734
AES-GCM Only              589       0.1088
CAMELLIA                  228296    42.1608
CAMELLIA Only             2         0.0004
CHACHA20                  72561     13.4003
CHACHA20 Only             1         0.0002
Insecure                  56630     10.4582
RC4                       178913    33.0409
RC4 Only                  577       0.1066
RC4 Preferred             18219     3.3646
RC4 forced in TLS1.1+     9446      1.7444
x:FF 29 3DES Only         574       0.106
x:FF 29 3DES Preferred    2103      0.3884
x:FF 29 RC4 Only          771       0.1424
x:FF 29 RC4 Preferred     20172     3.7253
x:FF 29 incompatible      395       0.0729
x:FF 35 3DES Only         582       0.1075
x:FF 35 3DES Preferred    2009      0.371
x:FF 35 RC4 Only          937       0.173
x:FF 35 RC4 Preferred     20230     3.736
x:FF 35 incompatible      398       0.0735
y:DHE-RSA-SEED-SHA        66504     12.2817
y:IDEA-CBC-SHA            63061     11.6459
y:SEED-SHA                78410     14.4804
z:ADH-AES128-GCM-SHA256   397       0.0733
z:ADH-AES128-SHA          714       0.1319
z:ADH-AES128-SHA256       269       0.0497
z:ADH-AES256-GCM-SHA384   413       0.0763
z:ADH-AES256-SHA          723       0.1335
z:ADH-AES256-SHA256       271       0.05
z:ADH-CAMELLIA128-SHA     358       0.0661
z:ADH-CAMELLIA256-SHA     366       0.0676
z:ADH-DES-CBC-SHA         298       0.055
z:ADH-DES-CBC3-SHA        722       0.1333
z:ADH-RC4-MD5             560       0.1034
z:ADH-SEED-SHA            286       0.0528
z:AECDH-AES128-SHA        9282      1.7142
z:AECDH-AES256-SHA        9332      1.7234
z:AECDH-DES-CBC3-SHA      9248      1.7079
z:AECDH-NULL-SHA          61        0.0113
z:AECDH-RC4-SHA           8710      1.6085
z:DES-CBC-MD5             10050     1.856
z:DES-CBC-SHA             35379     6.5337
z:DES-CBC3-MD5            21189     3.9131
z:ECDHE-RSA-NULL-SHA      67        0.0124
z:EDH-RSA-DES-CBC-SHA     30295     5.5948
z:EXP-ADH-DES-CBC-SHA     192       0.0355
z:EXP-ADH-RC4-MD5         189       0.0349
z:EXP-DES-CBC-SHA         13046     2.4093
z:EXP-EDH-RSA-DES-CBC-SHA 10364     1.914
z:EXP-RC2-CBC-MD5         15781     2.9144
z:EXP-RC4-MD5             16506     3.0483
z:EXP1024-DES-CBC-SHA     4104      0.7579
z:EXP1024-RC4-SHA         4194      0.7745
z:IDEA-CBC-MD5            2095      0.3869
z:NULL-MD5                211       0.039
z:NULL-SHA                210       0.0388
z:NULL-SHA256             30        0.0055
z:RC2-CBC-MD5             10224     1.8881
z:RC4-64-MD5              892       0.1647

Cipher ordering           Count     Percent
-------------------------+---------+-------
Client side               133145    24.5887
Server side               408344    75.4113

Supported Handshakes      Count     Percent
-------------------------+---------+-------
ADH                       874       0.1614
AECDH                     9353      1.7273
DHE                       292291    53.9791
ECDH                      2         0.0004
ECDHE                     448914    82.9036
ECDHE and DHE             235557    43.5017
RSA                       475602    87.8323

Supported PFS             Count     Percent  PFS Percent
-------------------------+---------+--------+-----------
DH,1024bits               152465    28.1566  52.1621
DH,1338bits               1         0.0002   0.0003
DH,1536bits               1         0.0002   0.0003
DH,2048bits               131006    24.1937  44.8204
DH,2236bits               13        0.0024   0.0044
DH,2432bits               2         0.0004   0.0007
DH,2560bits               1         0.0002   0.0003
DH,3072bits               93        0.0172   0.0318
DH,3092bits               1         0.0002   0.0003
DH,4096bits               8605      1.5891   2.944
DH,4098bits               1         0.0002   0.0003
DH,512bits                50        0.0092   0.0171
DH,768bits                395       0.0729   0.1351
DH,8192bits               2         0.0004   0.0007
ECDH,B-571,570bits        1771      0.3271   0.3945
ECDH,K-163,163bits        1         0.0002   0.0002
ECDH,P-192,192bits        15        0.0028   0.0033
ECDH,P-224,224bits        84        0.0155   0.0187
ECDH,P-256,256bits        433613    80.0779  96.5916
ECDH,P-384,384bits        4499      0.8309   1.0022
ECDH,P-521,521bits        10705     1.977    2.3846
Prefer DH,1024bits        53883     9.9509   18.4347
Prefer DH,1536bits        1         0.0002   0.0003
Prefer DH,2048bits        6107      1.1278   2.0894
Prefer DH,3072bits        9         0.0017   0.0031
Prefer DH,4096bits        375       0.0693   0.1283
Prefer DH,768bits         52        0.0096   0.0178
Prefer ECDH,B-571,570bits 1556      0.2874   0.3466
Prefer ECDH,K-163,163bits 1         0.0002   0.0002
Prefer ECDH,P-224,224bits 81        0.015    0.018
Prefer ECDH,P-256,256bits 396887    73.2955  88.4105
Prefer ECDH,P-384,384bits 3290      0.6076   0.7329
Prefer ECDH,P-521,521bits 9642      1.7806   2.1479
Prefer PFS                471884    87.1456  0
Support PFS               505648    93.381   0

Supported ECC curves      Count     Percent 
-------------------------+---------+--------
brainpoolP256r1           2578      0.4761   
brainpoolP384r1           2579      0.4763   
brainpoolP512r1           2580      0.4765   
prime192v1                1446      0.267    
prime256v1                445477    82.2689  
prime256v1 Only           388604    71.7658  
secp160k1                 1397      0.258    
secp160r1                 1402      0.2589   
secp160r2                 1396      0.2578   
secp192k1                 1410      0.2604   
secp224k1                 1487      0.2746   
secp224r1                 4270      0.7886   
secp224r1 Only            1         0.0002   
secp256k1                 4033      0.7448   
secp384r1                 57392     10.5989  
secp384r1 Only            554       0.1023   
secp521r1                 26343     4.8649   
secp521r1 Only            142       0.0262   
sect163k1                 1402      0.2589   
sect163k1 Only            2         0.0004   
sect163r1                 1400      0.2585   
sect163r2                 1400      0.2585   
sect193r1                 1399      0.2584   
sect193r2                 1399      0.2584   
sect233k1                 1480      0.2733   
sect233r1                 1480      0.2733   
sect239k1                 1480      0.2733   
sect283k1                 3926      0.725    
sect283k1 Only            1         0.0002   
sect283r1                 3925      0.7249   
sect409k1                 3924      0.7247   
sect409r1                 3923      0.7245   
sect571k1                 3928      0.7254   
sect571r1                 3929      0.7256   

Unsupported curve fallback     Count     Percent 
------------------------------+---------+--------
False                          55946     10.3319  
True                           332237    61.3562  
order-specific                 60        0.0111   
unknown                        153246    28.3009  

ECC curve ordering        Count     Percent 
-------------------------+---------+--------
client                    6546      1.2089   
inconclusive-noecc        10        0.0018   
server                    439646    81.192   
unknown                   95287     17.5972  

TLSv1.2 PFS supported sigalgs  Count     Percent 
------------------------------+---------+--------
ECDSA-SHA1                     43763     8.082    
ECDSA-SHA1 Only                3         0.0006   
ECDSA-SHA224                   43755     8.0805   
ECDSA-SHA256                   58463     10.7967  
ECDSA-SHA384                   58458     10.7958  
ECDSA-SHA512                   58458     10.7958  
RSA-MD5                        93307     17.2316  
RSA-SHA1                       386583    71.3926  
RSA-SHA1 Only                  41287     7.6247   
RSA-SHA224                     320766    59.2378  
RSA-SHA256                     353383    65.2613  
RSA-SHA256 Only                6919      1.2778   
RSA-SHA384                     322845    59.6217  
RSA-SHA384 Only                1         0.0002   
RSA-SHA512                     322938    59.6389  
RSA-SHA512 Only                199       0.0368   

TLSv1.2 PFS ordering           Count     Percent 
------------------------------+---------+--------
client                         245811    45.3954  
indeterminate                  42        0.0078   
intolerant                     5114      0.9444   
order-fallback                 9         0.0017   
server                         187931    34.7063  
unsupported                    19787     3.6542   

TLSv1.2 PFS sigalg fallback    Count     Percent 
------------------------------+---------+--------
ECDSA SHA1                     43750     8.0796   
ECDSA intolerant               30        0.0055   
ECDSA pfs-rsa-SHA512           14685     2.712    
ECDSA soft-nopfs               1         0.0002   
RSA False                      92525     17.0871  
RSA SHA1                       265644    49.0581  
RSA intolerant                 37307     6.8897   
RSA pfs-ecdsa-SHA512           1         0.0002   
RSA soft-nopfs                 863       0.1594   

Renegotiation             Count     Percent 
-------------------------+---------+--------
False                     6052      1.1177   
insecure                  17380     3.2097   
secure                    518057    95.6727  

Compression               Count     Percent 
-------------------------+---------+--------
1 (zlib compression)      8694      1.6056   
False                     6052      1.1177   
NONE                      526743    97.2768  

TLS session ticket hint   Count     Percent 
-------------------------+---------+--------
1                         5         0.0009   
1 only                    5         0.0009   
2                         1         0.0002   
2 only                    1         0.0002   
5                         1         0.0002   
5 only                    1         0.0002   
10                        11        0.002    
10 only                   11        0.002    
15                        9         0.0017   
15 only                   9         0.0017   
30                        14        0.0026   
30 only                   12        0.0022   
60                        158       0.0292   
60 only                   152       0.0281   
65                        1         0.0002   
65 only                   1         0.0002   
70                        7         0.0013   
75                        1         0.0002   
75 only                   1         0.0002   
100                       13        0.0024   
100 only                  13        0.0024   
120                       25        0.0046   
120 only                  25        0.0046   
128                       3         0.0006   
128 only                  3         0.0006   
150                       2         0.0004   
180                       59        0.0109   
180 only                  56        0.0103   
240                       6         0.0011   
240 only                  6         0.0011   
244                       1         0.0002   
244 only                  1         0.0002   
300                       257671    47.5856  
300 only                  253451    46.8063  
302                       3         0.0006   
302 only                  3         0.0006   
360                       2         0.0004   
360 only                  1         0.0002   
400                       6         0.0011   
400 only                  6         0.0011   
420                       114       0.0211   
420 only                  91        0.0168   
450                       1         0.0002   
450 only                  1         0.0002   
480                       13        0.0024   
480 only                  13        0.0024   
500                       4         0.0007   
500 only                  4         0.0007   
540                       1         0.0002   
540 only                  1         0.0002   
600                       27406     5.0612   
600 only                  27252     5.0328   
720                       2         0.0004   
720 only                  2         0.0004   
840                       2         0.0004   
840 only                  2         0.0004   
900                       989       0.1826   
900 only                  972       0.1795   
960                       3         0.0006   
960 only                  3         0.0006   
1200                      2741      0.5062   
1200 only                 2735      0.5051   
1500                      6         0.0011   
1500 only                 5         0.0009   
1800                      555       0.1025   
1800 only                 545       0.1006   
1980                      2         0.0004   
1980 only                 2         0.0004   
2100                      2         0.0004   
2100 only                 1         0.0002   
2400                      9         0.0017   
2400 only                 9         0.0017   
2700                      11        0.002    
2700 only                 11        0.002    
3000                      29        0.0054   
3000 only                 29        0.0054   
3300                      1         0.0002   
3300 only                 1         0.0002   
3600                      688       0.1271   
3600 only                 679       0.1254   
3900                      1         0.0002   
3900 only                 1         0.0002   
5160                      1         0.0002   
5160 only                 1         0.0002   
5400                      13        0.0024   
5400 only                 7         0.0013   
6000                      235       0.0434   
6000 only                 235       0.0434   
7200                      15880     2.9327   
7200 only                 15854     2.9279   
10800                     3309      0.6111   
10800 only                3300      0.6094   
14400                     100       0.0185   
14400 only                100       0.0185   
18000                     8         0.0015   
18000 only                8         0.0015   
21600                     4676      0.8635   
21600 only                4676      0.8635   
25200                     1         0.0002   
25200 only                1         0.0002   
28800                     2453      0.453    
28800 only                2450      0.4525   
36000                     1094      0.202    
36000 only                1083      0.2      
43200                     41        0.0076   
43200 only                41        0.0076   
60000                     2         0.0004   
60000 only                2         0.0004   
64800                     4295      0.7932   
64800 only                4295      0.7932   
72000                     28        0.0052   
72000 only                28        0.0052   
79200                     1         0.0002   
79200 only                1         0.0002   
86000                     48        0.0089   
86000 only                48        0.0089   
86400                     3671      0.6779   
86400 only                3666      0.677    
100800                    10910     2.0148   
100800 only               10897     2.0124   
115200                    1         0.0002   
115200 only               1         0.0002   
129600                    8         0.0015   
129600 only               8         0.0015   
172800                    10        0.0018   
172800 only               10        0.0018   
216000                    2         0.0004   
216000 only               2         0.0004   
259200                    2         0.0004   
259200 only               2         0.0004   
432000                    1         0.0002   
432000 only               1         0.0002   
604800                    1         0.0002   
864000                    3         0.0006   
864000 only               3         0.0006   
None                      208648    38.5323  
None only                 204120    37.6961  

Certificate sig alg     Count     Percent 
-------------------------+---------+--------
None                      9968      1.8408   
ecdsa-with-SHA256         58398     10.7847  
sha1WithRSAEncryption     51637     9.5361   
sha256WithRSAEncryption   446192    82.4009  
sha384WithRSAEncryption   5         0.0009   
sha512WithRSAEncryption   43        0.0079   

Certificate key size    Count     Percent 
-------------------------+---------+--------
ECDSA 256                 58449     10.7941  
ECDSA 384                 17        0.0031   
ECDSA 521                 1         0.0002   
RSA 1024                  20        0.0037   
RSA 2047                  1         0.0002   
RSA 2048                  473537    87.4509  
RSA 2049                  2         0.0004   
RSA 2056                  1         0.0002   
RSA 2058                  2         0.0004   
RSA 2064                  2         0.0004   
RSA 2084                  5         0.0009   
RSA 2096                  2         0.0004   
RSA 2408                  1         0.0002   
RSA 2432                  1         0.0002   
RSA 2480                  1         0.0002   
RSA 3071                  1         0.0002   
RSA 3072                  119       0.022    
RSA 3073                  1         0.0002   
RSA 3096                  2         0.0004   
RSA 3248                  2         0.0004   
RSA 4048                  1         0.0002   
RSA 4056                  18        0.0033   
RSA 4092                  6         0.0011   
RSA 4094                  1         0.0002   
RSA 4095                  1         0.0002   
RSA 4096                  24063     4.4439   
RSA 4098                  1         0.0002   
RSA 8192                  3         0.0006   
RSA/ECDSA Dual Stack      14756     2.7251

OCSP stapling             Count     Percent 
-------------------------+---------+--------
Supported                 125414    23.161   
Unsupported               416075    76.839   

Supported Protocols       Count     Percent
-------------------------+---------+-------
SSL2                      21373     3.9471
SSL2 Only                 15        0.0028
SSL3                      111129    20.5229
SSL3 Only                 1140      0.2105
SSL3 or TLS1 Only         59881     11.0586
SSL3 or lower Only        1155      0.2133
TLS1                      534137    98.6423
TLS1 Only                 37819     6.9843
TLS1 or lower Only        79028     14.5946
TLS1.1                    449426    82.9982
TLS1.1 Only               331       0.0611
TLS1.1 or up Only         5997      1.1075
TLS1.2                    458682    84.7075
TLS1.2 Only               2265      0.4183
TLS1.2, 1.0 but not 1.1   9518      1.7577

Statistics from 575515 chains provided by 712157 hosts

Server provided chains    Count     Percent
-------------------------+---------+-------
complete                  510961    71.7484
incomplete                28667     4.0254
untrusted                 172529    24.2263

Trusted chain statistics
========================

Chain length              Count     Percent
-------------------------+---------+-------
2                         26        0.0045
3                         573525    99.6542
4                         1952      0.3392
5                         12        0.0021

CA key size in chains     Count
-------------------------+---------
ECDSA 256                 58397     
ECDSA 384                 58400     
RSA 1024                  25        
RSA 2045                  2         
RSA 2048                  878262    
RSA 4096                  157894    

Chains with CA key        Count     Percent
-------------------------+---------+-------
ECDSA 256                 58397     10.1469
ECDSA 384                 58400     10.1474
RSA 1024                  23        0.004
RSA 2045                  2         0.0003
RSA 2048                  516745    89.7883
RSA 4096                  157333    27.3378

Signature algorithm (ex. root) Count
------------------------------+---------
ecdsa-with-SHA384              58394     
sha1WithRSAEncryption          58209     
sha256WithRSAEncryption        319412    
sha384WithRSAEncryption        141372    
sha512WithRSAEncryption        78        

Eff. host cert chain LoS  Count     Percent
-------------------------+---------+-------
80                        58271     10.125
112                       458828    79.7248
128.0                     58416     10.1502

Most Popular Root CAs                         Count     Percent
---------------------------------------------+---------+-------
(d6325660) COMODO RSA Certification Authority 126106    21.9119
(2c543cd1) GeoTrust Global CA                 102943    17.8871
(eed8c118) COMODO ECC Certification Authority 58387     10.1452
(5ad8a5d6) GlobalSign Root CA                 50714     8.8119
(cbf06781) Go Daddy Root Certificate Authorit 50524     8.7789
(b204d74a) VeriSign Class 3 Public Primary Ce 32049     5.5688
(244b5494) DigiCert High Assurance EV Root CA 21377     3.7144
(2e4eed3c) thawte Primary Root CA             20668     3.5912
(fc5a8f99) USERTrust RSA Certification Author 15152     2.6328
(157753a5) AddTrust External CA Root          14593     2.5356
(653b494a) Baltimore CyberTrust Root          11373     1.9761
(ae8153b9) StartCom Certification Authority   9025      1.5682
(3513523f) DigiCert Global Root CA            8982      1.5607
(4bfab552) Starfield Root Certificate Authori 8553      1.4861


Scan performed between 18th of January and 3rd of February 2016

October 2015 scan results

Because the previous two months were published with a much longer delay than usual (sorry about that, will explain myself in future post) the following analysis compares this month’s results to July, not September.

Number of servers supporting TLS has grown by over 4% during those 3 months. The most profound change during that time was decommissioning of over 10% of SHA-1 using certificates. Rest of changes is just continuation of established trends.

Cipher suites

3DES continues the somewhat surprising increase in support, gaining another 1.6%. AES in general and AES in CBC mode in particular have shown little change, gaining less than half a percent in use. AES-GCM has grown by over 5% at the same time. Similarly to AES, Camellia and ChaCha20 support is relatively stable, both gaining about 0.2% each.

Use of insecure ciphers has decreased somewhat, loosing nearly 3% since last publication of results. RC4 has lost a staggering 10% of market share, for the first time since scans began falling below Camellia levels.

Unfortunately, there are still over 1100 servers which require use of RC4 for a successful connection, or over 1600 if you’re using Firefox 35.

Use of server side cipher ordering also plateaued, with just 0.2% more servers opting to ignore client presented order of ciphers for negotiation.

Key exchange

Support for the modern ECDHE key exchange has grown by nearly 5% during that time, reaching over 79% of servers.

The older and slower DHE key exchange has lost 1.6% of support among the servers.

The insecure ADH and AECDH key exchanges have also fallen, the former to a level of below 1000 servers, the latter by 1.5% to just over 2.1%.

Most of the increases in the ECDHE support are due to P-256 NIST curve, gaining nearly 4.5%.

We also see very good changes in DHE support, use of 1024 bit prime has fallen by 9% while use of 2048 bit prime has risen by 8%. For ciphersuites effectively negotiated, the changes are a bit less pronounced, with just 4.1% less servers picking a DHE ciphersuite with 1024 bit prime, making connections to 11.4% of servers a bit less secure. While preference for 2048 bit DH risen by just 1.12%.

Overall, 1.6% more servers support ciphersuites that provide Forward Secrecy while a very nice 4.4% more actually prefer them.

As usual, the support for ECDHE is mostly driven by P-256 (a.k.a. prime256v1), with it gaining 4.8% more market share. One other curve has finally risen to the double digit level (though just barely), with an increase of 0.2% – P-384, a.k.a. secp384r1.

Hash and signature algorithms

Support for SHA256 with RSA certificates has grown by nearly 5%, stronger hashes have seen smaller changes with SHA384 and SHA512 gaining only 3.8%.

Support for the insecure MD5 is also increasing, thankfully at a slower rate, with it gaining only 0.7%. Number of servers that support only the rather weak SHA1 is decreasing though, over those 3 months it has fallen by 1.2%.

Vulnerabilities

Support for secure renegotiation is still missing in 3.6% of servers, loosing just over half a percent. Similarly, 1.2% of servers are vulnerable to the CRIME attack, a change of only 0.2%.

Certificates

Certificates used by servers have seen comparatively the biggest change. SHA-1 use has fallen by nearly 13%! The switch was shared by SHA-256 with RSA (increase by just over 12%) and SHA-256 with ECDSA (increase by 2.6%).

We’ve also finally reached a “less than 100 servers with 1024 bit RSA keys” milestone. Use of 2048 bit RSA has fallen by just one percent, at the same time use of 256 bit ECDSA has grown by 2.67%.

The list of CA’s with more than 1% of servers have also shrunk by 2 positions.

Protocols

Still over half a thousand of servers support only the insecure SSLv2 and SSLv3 protocols.

At the same time, more than 4 in 5 servers support the newest and most secure TLS v1.2 protocol.

Results

SSL/TLS survey of 523658 websites from Alexa's top 1 million
Stats only from connections that did provide valid certificates
(or anonymous DH from servers that do also have valid certificate installed)


Supported Ciphers         Count     Percent
-------------------------+---------+-------
3DES                      450366    86.0038
3DES Only                 598       0.1142
AES                       516026    98.5426
AES Only                  22924     4.3777
AES-CBC                   515568    98.4551
AES-CBC Only              10087     1.9263
AES-GCM                   388464    74.1828
AES-GCM Only              378       0.0722
CAMELLIA                  234209    44.7256
CAMELLIA Only             3         0.0006
CHACHA20                  64701     12.3556
CHACHA20 Only             1         0.0002
Insecure                  61963     11.8327
RC4                       213861    40.8398
RC4 Only                  1101      0.2103
RC4 Preferred             22873     4.3679
RC4 forced in TLS1.1+     11792     2.2519
x:FF 29 RC4 Only          1377      0.263
x:FF 29 RC4 Preferred     26049     4.9744
x:FF 29 incompatible      312       0.0596
x:FF 35 RC4 Only          1656      0.3162
x:FF 35 RC4 Preferred     26149     4.9935
x:FF 35 incompatible      315       0.0602
y:DHE-RSA-SEED-SHA        84215     16.0821
y:IDEA-CBC-SHA            78851     15.0577
y:SEED-SHA                95873     18.3083
z:ADH-AES128-GCM-SHA256   395       0.0754
z:ADH-AES128-SHA          756       0.1444
z:ADH-AES128-SHA256       295       0.0563
z:ADH-AES256-GCM-SHA384   403       0.077
z:ADH-AES256-SHA          764       0.1459
z:ADH-AES256-SHA256       297       0.0567
z:ADH-CAMELLIA128-SHA     380       0.0726
z:ADH-CAMELLIA256-SHA     388       0.0741
z:ADH-DES-CBC-SHA         305       0.0582
z:ADH-DES-CBC3-SHA        775       0.148
z:ADH-RC4-MD5             638       0.1218
z:ADH-SEED-SHA            313       0.0598
z:AECDH-AES128-SHA        11266     2.1514
z:AECDH-AES256-SHA        11290     2.156
z:AECDH-DES-CBC3-SHA      11231     2.1447
z:AECDH-NULL-SHA          59        0.0113
z:AECDH-RC4-SHA           10599     2.024
z:DES-CBC-MD5             11791     2.2517
z:DES-CBC-SHA             36853     7.0376
z:DES-CBC3-MD5            24006     4.5843
z:ECDHE-RSA-NULL-SHA      63        0.012
z:EDH-RSA-DES-CBC-SHA     31633     6.0408
z:EXP-ADH-DES-CBC-SHA     208       0.0397
z:EXP-ADH-RC4-MD5         205       0.0391
z:EXP-DES-CBC-SHA         15360     2.9332
z:EXP-EDH-RSA-DES-CBC-SHA 12356     2.3596
z:EXP-RC2-CBC-MD5         18735     3.5777
z:EXP-RC4-MD5             19564     3.736
z:EXP1024-DES-CBC-SHA     4870      0.93
z:EXP1024-RC4-SHA         4967      0.9485
z:IDEA-CBC-MD5            2349      0.4486
z:NULL-MD5                227       0.0433
z:NULL-SHA                232       0.0443
z:NULL-SHA256             29        0.0055
z:RC2-CBC-MD5             12033     2.2979
z:RC4-64-MD5              968       0.1849

Cipher ordering           Count     Percent
-------------------------+---------+-------
Client side               134694    25.7217
Server side               388964    74.2783

Supported Handshakes      Count     Percent
-------------------------+---------+-------
ADH                       903       0.1724
AECDH                     11321     2.1619
DHE                       286818    54.772
ECDH                      3         0.0006
ECDHE                     415495    79.3447
ECDHE and DHE             219028    41.8265
RSA                       471189    89.9803

Supported PFS             Count     Percent  PFS Percent
-------------------------+---------+--------+-----------
DH,1024bits               162798    31.0886  56.76
DH,1536bits               1         0.0002   0.0003
DH,2048bits               116370    22.2225  40.5728
DH,2236bits               11        0.0021   0.0038
DH,2432bits               1         0.0002   0.0003
DH,3072bits               109       0.0208   0.038
DH,3092bits               1         0.0002   0.0003
DH,4094bits               1         0.0002   0.0003
DH,4096bits               7102      1.3562   2.4761
DH,512bits                43        0.0082   0.015
DH,768bits                450       0.0859   0.1569
DH,8192bits               2         0.0004   0.0007
ECDH,B-571,570bits        1628      0.3109   0.3918
ECDH,K-163,163bits        1         0.0002   0.0002
ECDH,K-571,570bits        1         0.0002   0.0002
ECDH,P-192,192bits        8         0.0015   0.0019
ECDH,P-224,224bits        71        0.0136   0.0171
ECDH,P-256,256bits        402982    76.9552  96.9884
ECDH,P-384,384bits        2860      0.5462   0.6883
ECDH,P-521,521bits        8826      1.6855   2.1242
Prefer DH,1024bits        59986     11.4552  20.9143
Prefer DH,1536bits        1         0.0002   0.0003
Prefer DH,2048bits        9957      1.9014   3.4715
Prefer DH,3072bits        13        0.0025   0.0045
Prefer DH,4096bits        345       0.0659   0.1203
Prefer DH,768bits         65        0.0124   0.0227
Prefer ECDH,B-571,570bits 1429      0.2729   0.3439
Prefer ECDH,K-163,163bits 1         0.0002   0.0002
Prefer ECDH,K-571,570bits 1         0.0002   0.0002
Prefer ECDH,P-224,224bits 55        0.0105   0.0132
Prefer ECDH,P-256,256bits 358890    68.5352  86.3765
Prefer ECDH,P-384,384bits 2659      0.5078   0.64
Prefer ECDH,P-521,521bits 7931      1.5145   1.9088
Prefer PFS                441333    84.2789  0
Support PFS               483285    92.2902  0

Supported ECC curves      Count     Percent 
-------------------------+---------+--------
brainpoolP256r1           1825      0.3485   
brainpoolP384r1           1827      0.3489   
brainpoolP512r1           1828      0.3491   
prime192v1                1461      0.279    
prime256v1                413390    78.9427  
prime256v1 Only           360620    68.8656  
secp160k1                 1415      0.2702   
secp160r1                 1422      0.2716   
secp160r2                 1414      0.27     
secp192k1                 1433      0.2737   
secp224k1                 1489      0.2843   
secp224r1                 3846      0.7344   
secp256k1                 3218      0.6145   
secp384r1                 53089     10.1381  
secp384r1 Only            364       0.0695   
secp521r1                 22417     4.2808   
secp521r1 Only            125       0.0239   
sect163k1                 1415      0.2702   
sect163k1 Only            1         0.0002   
sect163r1                 1414      0.27     
sect163r2                 1414      0.27     
sect193r1                 1412      0.2696   
sect193r2                 1412      0.2696   
sect233k1                 1482      0.283    
sect233r1                 1481      0.2828   
sect239k1                 1481      0.2828   
sect283k1                 3187      0.6086   
sect283r1                 3187      0.6086   
sect409k1                 3189      0.609    
sect409r1                 3189      0.609    
sect571k1                 3201      0.6113   
sect571r1                 3201      0.6113   

Unsupported curve fallback     Count     Percent 
------------------------------+---------+--------
False                          70006     13.3686  
True                           291129    55.5953  
order-specific                 72        0.0137   
unknown                        162451    31.0223  

ECC curve ordering        Count     Percent 
-------------------------+---------+--------
client                    4674      0.8926   
inconclusive-noecc        10        0.0019   
server                    409225    78.1474  
unknown                   109749    20.9581  

TLSv1.2 PFS supported sigalgs  Count     Percent 
------------------------------+---------+--------
ECDSA-SHA1                     38366     7.3265   
ECDSA-SHA1 Only                3         0.0006   
ECDSA-SHA224                   38357     7.3248   
ECDSA-SHA256                   49346     9.4233   
ECDSA-SHA384                   49344     9.4229   
ECDSA-SHA512                   49347     9.4235   
ECDSA-SHA512 Only              3         0.0006   
RSA-MD5                        168481    32.1739  
RSA-SHA1                       361209    68.978   
RSA-SHA1 Only                  43815     8.3671   
RSA-SHA224                     296284    56.5797  
RSA-SHA256                     324294    61.9286  
RSA-SHA256 Only                5869      1.1208   
RSA-SHA384                     297506    56.813   
RSA-SHA384 Only                1         0.0002   
RSA-SHA512                     297620    56.8348  
RSA-SHA512 Only                137       0.0262   

TLSv1.2 PFS ordering           Count     Percent 
------------------------------+---------+--------
client                         238653    45.5742  
indeterminate                  202       0.0386   
intolerant                     4295      0.8202   
order-fallback                 10        0.0019   
server                         163641    31.2496  
unsupported                    21408     4.0882   

TLSv1.2 PFS sigalg fallback    Count     Percent 
------------------------------+---------+--------
ECDSA SHA1                     38349     7.3233   
ECDSA intolerant               24        0.0046   
ECDSA pfs-rsa-SHA512           10983     2.0974   
ECDSA soft-nopfs               1         0.0002   
RSA False                      167225    31.934   
RSA SHA1                       166732    31.8399  
RSA intolerant                 34038     6.5      
RSA pfs-ecdsa-SHA512           5         0.001    
RSA soft-nopfs                 1316      0.2513   

Renegotiation             Count     Percent 
-------------------------+---------+--------
False                     6661      1.272    
insecure                  19263     3.6785   
secure                    497734    95.0494  

Compression               Count     Percent 
-------------------------+---------+--------
1 (zlib compression)      9887      1.8881   
False                     6661      1.272    
NONE                      507110    96.8399  

TLS session ticket hint   Count     Percent 
-------------------------+---------+--------
1                         2         0.0004   
1 only                    2         0.0004   
2                         2         0.0004   
2 only                    2         0.0004   
5                         2         0.0004   
5 only                    2         0.0004   
10                        8         0.0015   
10 only                   8         0.0015   
15                        9         0.0017   
15 only                   9         0.0017   
30                        10        0.0019   
30 only                   9         0.0017   
60                        96        0.0183   
60 only                   89        0.017    
65                        1         0.0002   
65 only                   1         0.0002   
70                        7         0.0013   
75                        1         0.0002   
75 only                   1         0.0002   
100                       18        0.0034   
100 only                  18        0.0034   
120                       26        0.005    
120 only                  26        0.005    
128                       3         0.0006   
128 only                  3         0.0006   
150                       2         0.0004   
180                       42        0.008    
180 only                  39        0.0074   
200                       1         0.0002   
200 only                  1         0.0002   
240                       12        0.0023   
240 only                  12        0.0023   
300                       242606    46.3291  
300 only                  238057    45.4604  
302                       3         0.0006   
302 only                  3         0.0006   
360                       2         0.0004   
360 only                  1         0.0002   
400                       8         0.0015   
400 only                  8         0.0015   
420                       119       0.0227   
420 only                  88        0.0168   
480                       12        0.0023   
480 only                  12        0.0023   
500                       5         0.001    
500 only                  5         0.001    
540                       1         0.0002   
540 only                  1         0.0002   
600                       25719     4.9114   
600 only                  25574     4.8837   
700                       1         0.0002   
700 only                  1         0.0002   
720                       2         0.0004   
720 only                  2         0.0004   
840                       1         0.0002   
840 only                  1         0.0002   
900                       781       0.1491   
900 only                  766       0.1463   
960                       2         0.0004   
960 only                  2         0.0004   
1200                      2230      0.4259   
1200 only                 2222      0.4243   
1320                      1         0.0002   
1320 only                 1         0.0002   
1500                      10        0.0019   
1500 only                 9         0.0017   
1800                      490       0.0936   
1800 only                 476       0.0909   
2100                      1         0.0002   
2100 only                 1         0.0002   
2400                      8         0.0015   
2400 only                 8         0.0015   
2700                      8         0.0015   
2700 only                 8         0.0015   
3000                      23        0.0044   
3000 only                 23        0.0044   
3600                      575       0.1098   
3600 only                 566       0.1081   
3900                      1         0.0002   
3900 only                 1         0.0002   
4100                      1         0.0002   
4100 only                 1         0.0002   
4200                      1         0.0002   
5160                      1         0.0002   
5160 only                 1         0.0002   
5400                      20        0.0038   
5400 only                 8         0.0015   
6000                      66        0.0126   
6000 only                 66        0.0126   
7200                      14981     2.8608   
7200 only                 14963     2.8574   
10800                     2576      0.4919   
10800 only                2570      0.4908   
14400                     102       0.0195   
14400 only                102       0.0195   
18000                     7         0.0013   
18000 only                7         0.0013   
21600                     4999      0.9546   
21600 only                4999      0.9546   
25200                     1         0.0002   
25200 only                1         0.0002   
28800                     2018      0.3854   
28800 only                1601      0.3057   
36000                     1153      0.2202   
36000 only                1144      0.2185   
43200                     34        0.0065   
43200 only                34        0.0065   
60000                     1         0.0002   
60000 only                1         0.0002   
64800                     53897     10.2924  
64800 only                53896     10.2922  
72000                     16        0.0031   
72000 only                16        0.0031   
84600                     1         0.0002   
84600 only                1         0.0002   
86000                     39        0.0074   
86000 only                39        0.0074   
86400                     3516      0.6714   
86400 only                3512      0.6707   
100800                    10300     1.9669   
100800 only               10290     1.965    
129600                    9         0.0017   
129600 only               9         0.0017   
172800                    6         0.0011   
172800 only               6         0.0011   
216000                    1         0.0002   
216000 only               1         0.0002   
432000                    2         0.0004   
432000 only               2         0.0004   
604800                    1         0.0002   
864000                    4         0.0008   
864000 only               4         0.0008   
None                      162322    30.9977  
None only                 157058    29.9925  

Certificate sig alg     Count     Percent 
-------------------------+---------+--------
None                      11981     2.2879   
ecdsa-with-SHA256         49307     9.4159   
sha1WithRSAEncryption     86227     16.4663  
sha256WithRSAEncryption   399420    76.275   
sha384WithRSAEncryption   6         0.0011   
sha512WithRSAEncryption   28        0.0053   

Certificate key size    Count     Percent 
-------------------------+---------+--------
ECDSA 256                 49343     9.4228   
ECDSA 384                 15        0.0029   
RSA 1024                  56        0.0107   
RSA 10240                 8         0.0015   
RSA 2047                  1         0.0002   
RSA 2048                  464934    88.7858  
RSA 2049                  4         0.0008   
RSA 2056                  4         0.0008   
RSA 2058                  2         0.0004   
RSA 2064                  2         0.0004   
RSA 2084                  4         0.0008   
RSA 2096                  2         0.0004   
RSA 2408                  2         0.0004   
RSA 2432                  1         0.0002   
RSA 2480                  1         0.0002   
RSA 3071                  1         0.0002   
RSA 3072                  127       0.0243   
RSA 3096                  2         0.0004   
RSA 3248                  2         0.0004   
RSA 4042                  1         0.0002   
RSA 4048                  1         0.0002   
RSA 4056                  25        0.0048   
RSA 4069                  3         0.0006   
RSA 4086                  2         0.0004   
RSA 4092                  6         0.0011   
RSA 4094                  1         0.0002   
RSA 4096                  20149     3.8477   
RSA 4098                  1         0.0002   
RSA 8192                  4         0.0008   
RSA/ECDSA Dual Stack      11039     2.1081

OCSP stapling             Count     Percent 
-------------------------+---------+--------
Supported                 113302    21.6366  
Unsupported               410356    78.3634  

Supported Protocols       Count     Percent
-------------------------+---------+-------
SSL2                      24244     4.6297
SSL2 Only                 19        0.0036
SSL3                      122263    23.3479
SSL3 Only                 484       0.0924
SSL3 or TLS1 Only         69496     13.2713
SSL3 or lower Only        503       0.0961
TLS1                      518406    98.9971
TLS1 Only                 41584     7.9411
TLS1 or lower Only        92178     17.6027
TLS1.1                    418156    79.8529
TLS1.1 Only               267       0.051
TLS1.1 or up Only         4492      0.8578
TLS1.2                    428200    81.7709
TLS1.2 Only               1845      0.3523
TLS1.2, 1.0 but not 1.1   10863     2.0744



Statistics from 549280 chains provided by 697275 hosts

Server provided chains    Count     Percent
-------------------------+---------+-------
complete                  487661    69.9381
incomplete                27391     3.9283
untrusted                 182223    26.1336

Trusted chain statistics
========================

Chain length              Count     Percent
-------------------------+---------+-------
2                         114       0.0208
3                         547038    99.5918
4                         2101      0.3825
5                         27        0.0049

CA key size in chains     Count
-------------------------+---------
ECDSA 256                 48991     
ECDSA 384                 48992     
RSA 1024                  101       
RSA 2045                  3         
RSA 2048                  865095    
RSA 4096                  137419    

Chains with CA key        Count     Percent
-------------------------+---------+-------
ECDSA 256                 48991     8.9191
ECDSA 384                 48992     8.9193
RSA 1024                  99        0.018
RSA 2045                  3         0.0005
RSA 2048                  499889    91.008
RSA 4096                  136911    24.9255

Signature algorithm (ex. root) Count
------------------------------+---------
ecdsa-with-SHA384              48986     
sha1WithRSAEncryption          92825     
sha256WithRSAEncryption        287083    
sha384WithRSAEncryption        122355    
sha512WithRSAEncryption        72        

Eff. host cert chain LoS  Count     Percent
-------------------------+---------+-------
80                        92922     16.9171
112                       407358    74.1622
128                       49000     8.9208

Root CAs                                      Count     Percent
---------------------------------------------+---------+-------
(d6325660) COMODO RSA Certification Authority 113492    20.662
(2c543cd1) GeoTrust Global CA                 107601    19.5895
(eed8c118) COMODO ECC Certification Authority 48977     8.9166
(cbf06781) Go Daddy Root Certificate Authorit 47939     8.7276
(5ad8a5d6) GlobalSign Root CA                 44123     8.0329
(b204d74a) VeriSign Class 3 Public Primary Ce 29359     5.345
(244b5494) DigiCert High Assurance EV Root CA 25999     4.7333
(2e4eed3c) thawte Primary Root CA             23372     4.255
(157753a5) AddTrust External CA Root          20188     3.6754
(653b494a) Baltimore CyberTrust Root          12053     2.1943
(ae8153b9) StartCom Certification Authority   9139      1.6638
(fc5a8f99) USERTrust RSA Certification Author 8775      1.5975
(3513523f) DigiCert Global Root CA            8281      1.5076
(4bfab552) Starfield Root Certificate Authori 8226      1.4976
(480720ec) GeoTrust Primary Certification Aut 5570      1.0141


Scan performed between 19th of October and 9th of November 2015