Defaults.Exposed › October 2026 census › v10 registry › Certificate valid
Certificate valid
Methodology v10 · canonical ID cert-valid · TLS (Transport Layer Security) & Certificates · scored
A trusted, correctly-issued certificate; an invalid one throws scary browser warnings.
Certificate valid: definition
| Canonical ID | cert-valid |
|---|---|
| Category | TLS & Certificates |
| Grade impact | Scored, counts toward the grade |
| Pass | The presented certificate chain validates to a trusted root, matches the hostname, and is within its validity period. |
| Fail | The certificate is self-signed, expired, name-mismatched, or otherwise fails validation. |
| Example (passing) | CN=example.com, issued by a publicly trusted CA, chain validates |
Certificate valid across the census
89.2% of HTTPS-serving domains present a valid, trusted certificate (196,381,007 of 220,264,382, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
Certificate valid is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 112,227,937 of the 332,492,319 graded domains had no determinable result for this check: the check needs a completed HTTPS (Hypertext Transfer Protocol Secure) connection, so domains without one are outside its base.
Every outcome in the census
| Outcome | Domains | Share of HTTPS-serving domains | In the headline figure |
|---|---|---|---|
| Certificate validates | 196,381,007 | 89.2% | Yes |
| Certificate fails validation | 23,883,375 | 10.8% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of HTTPS-serving domains that present a valid, trusted certificate by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 147,859,634 domains | 89.6% | .bet 97.5%, .wiki 96.3%, .app 95.1% | .bond 50.9%, .icu 75.6%, .cyou 80.2% |
| Country-code TLDs (ccTLDs): 167 TLDs, 72,019,660 domains | 88.2% | .ai 97.7%, .cl 97.3%, .pk 96.4% | .sk 74.2%, .dk 74.4%, .kr 77.6% |
The largest TLD in this base, .com, stands at 90.0% (91,461,786 of 101,602,779).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 219,879,294 of the 220,264,382 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 6 TLS & Certificates checks with a published figure, Certificate valid has the 5th highest pass share. Next above it is Certificate expiry: 95.8% of domains whose certificate expiry date could be read. Next below it is HTTPS available: 66.2% of graded domains. Across every check with a published figure it ranks 7th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Self-signed certificates among the failures
The census certificate evidence records 23,883,375 failing certificates, of which 4,390,979 (18.4%) are self-signed. That evidence is a raw pass that includes about 1.1% re-scan duplicates, so its counts sit slightly above the deduplicated table; the proportion is unaffected.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix TLS certificate health
Cite this check
Defaults.Exposed, "Certificate valid (cert-valid)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/cert-valid
Permalink: https://defaults.exposed/methodology/cert-valid ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data