WebPKI Observatory — Concentration Risk
The top three CAs issue 71% of all certificates and the HHI of 1981 signals moderate concentration with systemic risk concentrated in fewer than five organizations. ISRG's 32% share means nearly one-third of the encrypted web depends on a single nonprofit's operational continuity. When combined with the 88 total trusted CAs, the market shows a bifurcated structure where a small oligopoly serves the vast majority of the web while a long tail of 74 CAs holds the same root store privileges despite minimal market presence.