WebPKI Observatory
Quantitative analysis of the Certificate Authority ecosystem that underpins TLS on the public internet. Data updated daily from Certificate Transparency logs, CCADB, Mozilla Bugzilla, and CA/Browser Forum records. Last updated 2026-11-01.
CA Market Share
Five CAs control 88% of all publicly trusted certificates, with ISRG leading at 32% share, followed by Google Trust Services at 21% and DigiCert at 18%. Market concentration measured by HHI stands at 1981, indicating a moderately concentrated market where a handful of players dominate while 74 tail CAs collectively issue the remaining volume. This structure creates systemic dependencies where operational failures at top providers would immediately affect a third of the encrypted web.
- Internet Security Research Group: 32.0% of unexpired certificates
- Google Trust Services LLC: 21.1% of unexpired certificates
- DigiCert: 17.8% of unexpired certificates
- GoDaddy: 10.4% of unexpired certificates
- Sectigo: 6.7% of unexpired certificates
The top 3 CAs account for 71.0% of all certificate issuance. The top 5 account for 88.1%. HHI concentration index: 1,981 (above 2,500 is considered highly concentrated). 88 Certificate Authorities are currently trusted by at least one major root program.
CA Compliance Incidents
1,716 total compliance incidents have been recorded across 55 CAs, with misissuance leading at 658 cases, followed by 555 governance failures and 372 revocation issues. CAs self-report only 30% of their own incidents, while external researchers discover 17%, automated tools find 15%, and formal audits catch just 7%, revealing a systemic detection gap. Of the 1,716 incidents, 230 represent explicit policy failures, 157 involve disclosure failures, and 110 were audit findings, demonstrating that even third-party oversight misses the majority of compliance breakdowns.
1,716 compliance incidents across 55 Certificate Authorities have been publicly documented in Mozilla Bugzilla since 2014.
- Misissuance: 658 incidents (38%)
- Governance: 555 incidents (32%)
- Revocation: 372 incidents (22%)
- Validation: 131 incidents (8%)
Of these incidents: 230 involved CAs violating their own documented policies, 157 involved failure to disclose issues on time, and 110 were discovered by auditors rather than by the CA itself.
Who discovers CA compliance incidents: root programs find 4%, automated tools (CT log monitors, linters) find 15%, and CAs' own monitoring accounts for only 30%.
CA Distrust Events
16 browser distrust events have been recorded, with 14 triggered by compliance or operational failures and 10 involving patterns of repeated issues rather than isolated incidents. Root program analysis classified CA posture as negligent noncompliance in 7 cases, demonstrated incompetence in 3, and willful circumvention in 3, showing that distrust typically follows sustained dysfunction rather than single mistakes. The median runway from distrust announcement to final removal is 1,185 days, giving relying parties over three years to migrate but also extending the period where distrusted CAs remain active in some contexts.
16 Certificate Authorities have been removed from browser trust stores since 2011. 14 of these events involved compliance operations failures — inadequate incident response, concealment, or patterns of unresolved issues. 10 had documented recurring patterns of issues across multiple years.
Root Program Governance
Chrome provided substantive oversight comments on 18% of the 223 compliance incidents in 2025, down from 68% coverage in 2019, while Mozilla dropped from 78% to 10% and Apple covered just 5%. Microsoft provided zero substantive comments in 2025 despite operating a root program with 142 unique roots. This declining oversight trend concentrates governance burden on Chrome's 115 recent substantive comments while reducing accountability for the 82% of incidents that receive no public root program engagement.
Root program oversight coverage as a percentage of all CA compliance bugs: Chrome covered 67.8% in 2019 and 18.4% in 2025. Mozilla covered 78.0% in 2019 and 9.9% in 2025. Microsoft has made 0 governance comments on other CAs' compliance incidents across 2,008 total bugs.
CA/B Forum Ecosystem Participation
56 organizations hold CA/B Forum membership but only 21 contribute actively to ballot development, leaving 35 with zero contribution to the standards they must implement. Stephen Davidson of Sectigo has proposed 36 ballots, demonstrating concentrated policy leadership within a small group of participants. This participation gap means a minority of CAs shape requirements binding on all 88 trusted authorities, while the silent majority implements standards without contributing to their design.
Of 56 CA/Browser Forum CA members, 21 have recorded community contributions and 35 have made no recorded public contribution to Bugzilla, ballot proposals, or bug filing.
Most active organizations: Sectigo, DigiCert, HARICA, Let's Encrypt, iSigma.
Geographic Distribution
US-incorporated CAs issue 93% of all publicly trusted certificates despite representing only 15 of the 88 trusted authorities, while 44 European CAs collectively hold 7% share and 17 Asia-Pacific CAs account for 0.09%. This geographic concentration means American corporate governance, bankruptcy law, and regulatory jurisdiction effectively control the global certificate infrastructure. The gap between CA count and issuance share reveals that most non-US CAs operate as trusted but minimally-used tail providers, holding global privileges while serving regional or niche markets.
- United States: 15 CAs, 92.8% of certificate issuance
- Europe: 44 CAs, 7.2% of certificate issuance
- Asia-Pacific: 17 CAs, 0.1% of certificate issuance
- Americas: 2 CAs, 0.0% of certificate issuance
- Middle East / Africa: 6 CAs, 0.0% of certificate issuance
Government-Operated Certificate Authorities
30 government-operated or state-owned CAs hold positions in global trust stores but collectively issue only 0.09% of certificates, concentrated primarily in Asia-Pacific jurisdictions. These CAs possess technical capability to issue certificates for any domain despite minimal legitimate market presence, creating a trust surface that extends far beyond their operational footprint. The presence of state-controlled CAs in root programs represents a persistent governance challenge where geopolitical considerations intersect with technical trust decisions.
30 government-operated or state-owned Certificate Authorities hold trust in major browser root stores, accounting for 0.1% of certificate issuance.
Machine-readable dataset (JSON, ~68K tokens, updated daily)