cert-governance · severity medium
Certificate lifetime readiness
Share of newly issued certificates with a validity window longer than the 47-day maximum the CA/Browser Forum is phasing in — renewals that must be automated before the deadline.
Measured every Sunday · last updated
How it is measured
Read a Certificate Transparency log, parse each leaf, compute not_after − not_before. Entries are drawn as evenly spaced clusters across the 24 hours before the build, so every CA is represented in proportion to what it issued over the same period. Population unit: certificate; segmented by CA.
Why it matters
The same deadline seen from the supply side. It shows which CAs have already moved their customers to automated short-lived issuance and which are still writing certificates that will be non-compliant — a per-CA readiness table nobody else publishes.
Limits of this measurement
Measured over a sample of recent issuance, so it reflects current practice rather than the installed base. The 47-day threshold was chosen after a 100-day cut returned 0% everywhere — issuance had already moved below it, leaving no variance to observe. The sample is drawn in contiguous clusters rather than one certificate at a time, which widens the margin of error beyond what the sample size alone implies; the effect is small for a CA issuing steadily and largest for one that issues in bursts. A CA's figure covers only the sampled window, so a CA with low issuance in that window is suppressed rather than published thin. One further caveat on n, not on the rates: the sample is a fixed number of log entries however busy the log is, so the sampling fraction moves with the log's throughput — which halved between 2026-09-14 and 2026-09-27 (19.6M entries per 24h to 9.3M). Rates stay unbiased, but a segment's n tracks log volume as well as that issuer's own output, so week-to-week changes in n are not by themselves a change in issuance.
The base rate
Measured over the full population of certificates, from public bulk sources.
Every segment
Pick one to see the citable answer, with its trend and methodology.
From the newsletter
Where this base rate turned up as a real, fixable exposure.
Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.