Defaults.Exposed › October 2026 census › v10 registry › Key strength
Key strength
Methodology v10 · canonical ID cert-key-strength · TLS (Transport Layer Security) & Certificates · scored
Adequate key length so the encryption can't be brute-forced.
Key strength: definition
| Canonical ID | cert-key-strength |
|---|---|
| Category | TLS & Certificates |
| Grade impact | Scored, counts toward the grade |
| Pass | The certificate public key meets modern strength baselines (e.g. RSA ≥ 2048-bit or an equivalent EC key). |
| Fail | The key is below the baseline (e.g. RSA 1024-bit). |
| Example (passing) | Public key: RSA 2048-bit (or EC P-256) |
Key strength across the census
99.9% of domains whose certificate key could be read meet the modern key-strength baseline (220,111,943 of 220,271,422, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
Key strength is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 112,220,897 of the 332,492,319 graded domains had no determinable result for this check: the public key has to be read from a presented certificate, so domains without one are outside its base.
Every outcome in the census
| Outcome | Domains | Share of domains whose certificate key could be read | In the headline figure |
|---|---|---|---|
| Key meets the baseline | 220,111,943 | 99.9% | Yes |
| Key below the baseline | 159,479 | 0.07% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
Against the other checks
Among the 6 TLS & Certificates checks with a published figure, Key strength has the 2nd highest pass share. Next above it is TLS version: 100.0% of HTTPS-serving domains. Next below it is Signature algorithm: 99.6% of domains whose certificate signature algorithm could be read. Across every check with a published figure it ranks 2nd of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix TLS certificate health
Cite this check
Defaults.Exposed, "Key strength (cert-key-strength)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/cert-key-strength
Permalink: https://defaults.exposed/methodology/cert-key-strength ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data