{
 "metric": "cert-blast-radius",
 "segment": "ca-digicert-inc",
 "anchor": "cert",
 "label": "DigiCert Inc (certificates)",
 "population": "certificates issued by DigiCert Inc",
 "states": [
  "one_name",
  "few_names",
  "many_names",
  "sprawling_names",
  "wildcard"
 ],
 "quiet_failure_states": [],
 "measurement": "**bulk read of a public CT log — nothing is probed.** For each certificate in the same 24h window `cert-validity-window` samples, the number of DNS names it covers, banded: single / small (2–9) / large (10–99) / sprawling (100+). A wildcard certificate is reported as `wildcard` regardless of count, because its reach is unbounded. Population unit: **certificate**; segmented by **CA**.",
 "why_it_matters": "How many doors one private key opens. A leaked key, a botched renewal or a revocation takes every name on the certificate with it, so the count is the blast radius — and the per-CA cut shows which issuers' customers are concentrating risk that way. A wildcard is the sharpest version: it covers subdomains that did not exist when it was issued, including the forgotten ones that turn up in a takeover story.",
 "limits": "**A composition, not a verdict.** A CDN or platform serving a thousand tenants from one certificate is making a sound operational choice, and none of these states is published as a failure. Read alongside the issuing-CA cut rather than on its own: the distribution largely reflects what kind of customers a CA serves. Counts come from the SAN list as logged; a certificate re-issued with the same names appears once per issuance.",
 "data_tier": "ct_ecosystem",
 "population_predicate": "any",
 "entity_type": "cert",
 "kind": "context",
 "latest": {
  "day": "2026-10-01",
  "n": 2181,
  "qf_pct": 0,
  "ci": [
   0,
   0.18
  ],
  "dist": {
   "wildcard": 1.51,
   "sprawling_names": 0,
   "many_names": 0.05,
   "few_names": 1.42,
   "one_name": 97.02
  },
  "snapshot": "ct-window-24h-40000"
 },
 "series": [
  {
   "day": "2026-09-20",
   "n": 1501,
   "qf_pct": 0,
   "ci": [
    0,
    0.26
   ],
   "dist": {
    "wildcard": 2.07,
    "sprawling_names": 0,
    "many_names": 0.27,
    "few_names": 1.93,
    "one_name": 95.74
   },
   "snapshot": "ct-window-24h-40000"
  },
  {
   "day": "2026-09-27",
   "n": 2005,
   "qf_pct": 0,
   "ci": [
    0,
    0.19
   ],
   "dist": {
    "one_name": 95.81,
    "few_names": 1.6,
    "many_names": 0.1,
    "sprawling_names": 0,
    "wildcard": 2.49
   },
   "snapshot": "ct-window-24h-40000"
  },
  {
   "day": "2026-10-01",
   "n": 2181,
   "qf_pct": 0,
   "ci": [
    0,
    0.18
   ],
   "dist": {
    "wildcard": 1.51,
    "sprawling_names": 0,
    "many_names": 0.05,
    "few_names": 1.42,
    "one_name": 97.02
   },
   "snapshot": "ct-window-24h-40000"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/cert-blast-radius/ca-digicert-inc"
}