{
 "metric": "cert-blast-radius",
 "segment": "global",
 "anchor": "cert",
 "label": "all certificates",
 "population": "certificates worldwide",
 "states": [
  "one_name",
  "few_names",
  "many_names",
  "sprawling_names",
  "wildcard"
 ],
 "quiet_failure_states": [],
 "measurement": "**bulk read of a public CT log — nothing is probed.** For each certificate in the same 24h window `cert-validity-window` samples, the number of DNS names it covers, banded: single / small (2–9) / large (10–99) / sprawling (100+). A wildcard certificate is reported as `wildcard` regardless of count, because its reach is unbounded. Population unit: **certificate**; segmented by **CA**.",
 "why_it_matters": "How many doors one private key opens. A leaked key, a botched renewal or a revocation takes every name on the certificate with it, so the count is the blast radius — and the per-CA cut shows which issuers' customers are concentrating risk that way. A wildcard is the sharpest version: it covers subdomains that did not exist when it was issued, including the forgotten ones that turn up in a takeover story.",
 "limits": "**A composition, not a verdict.** A CDN or platform serving a thousand tenants from one certificate is making a sound operational choice, and none of these states is published as a failure. Read alongside the issuing-CA cut rather than on its own: the distribution largely reflects what kind of customers a CA serves. Counts come from the SAN list as logged; a certificate re-issued with the same names appears once per issuance.",
 "data_tier": "ct_ecosystem",
 "population_predicate": "any",
 "entity_type": "cert",
 "kind": "context",
 "latest": {
  "day": "2026-10-01",
  "n": 43849,
  "qf_pct": 0,
  "ci": [
   0,
   0.01
  ],
  "dist": {
   "wildcard": 37.29,
   "sprawling_names": 0.04,
   "many_names": 0.41,
   "few_names": 13.27,
   "one_name": 48.98
  },
  "snapshot": "ct-window-24h-40000"
 },
 "series": [
  {
   "day": "2026-09-20",
   "n": 44295,
   "qf_pct": 0,
   "ci": [
    0,
    0.01
   ],
   "dist": {
    "wildcard": 48.97,
    "sprawling_names": 0.03,
    "many_names": 0.33,
    "few_names": 11.33,
    "one_name": 39.33
   },
   "snapshot": "ct-window-24h-40000"
  },
  {
   "day": "2026-09-27",
   "n": 43737,
   "qf_pct": 0,
   "ci": [
    0,
    0.01
   ],
   "dist": {
    "few_names": 13.87,
    "many_names": 0.29,
    "sprawling_names": 0.03,
    "wildcard": 39.39,
    "one_name": 46.42
   },
   "snapshot": "ct-window-24h-40000"
  },
  {
   "day": "2026-10-01",
   "n": 43849,
   "qf_pct": 0,
   "ci": [
    0,
    0.01
   ],
   "dist": {
    "wildcard": 37.29,
    "sprawling_names": 0.04,
    "many_names": 0.41,
    "few_names": 13.27,
    "one_name": 48.98
   },
   "snapshot": "ct-window-24h-40000"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/cert-blast-radius/global"
}