Defaults.Exposed › Reports

Expired SSL Certificates: 5.2 Million Sites Still Serving

Published 2026-08-18

Figures as of 16 August 2026 · methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade or name an individual registrant’s domain.

How many websites are serving an expired certificate right now?

At the moment our August 2026 census swept the web, 5,157,928 live websites were presenting an expired TLS certificate — 2.23% of the 231,455,163 certificates we saw, or approximately one in every 45. These are not dead domains. Every one of them answered a connection, completed a TLS handshake, and handed over a certificate whose own validity period said: this should no longer be trusted.

The raw count is striking, but the age distribution is the real story. If expired certificates were mostly renewal slips — the cron job that failed on a Friday, the card that bounced — you would expect the expired population to cluster in the first few days and weeks past expiry. It does not. Only 8.9% of the expired certificates we observed had lapsed within the previous 30 days. Nearly half, 2,466,978 certificates, had been expired for more than a year. And 740,362 had been expired for more than five.

A certificate five years past expiry on a server that still answers is not an accident. It is a website nobody has looked at since before the pandemic-era internet, still switched on, still billing somebody for hosting, still greeting every visitor with a full-page browser warning.

Key numbers

• 5,157,928 live websites were serving an expired TLS certificate at capture time in the August 2026 census — 2.23% of the 231,455,163 certificates observed.
• Approximately 1 in 45 certificates presented by a live, responding website was expired.
• 91.1% of expired certificates (4,699,316) had been expired for more than 30 days — these are not fresh renewal slips.
• 2,466,978 certificates — 47.8% of all expired ones — lapsed over a year ago, the signature of abandonment rather than error.
• 740,362 live sites were serving a certificate that expired more than five years ago.
• Denominator: 231,455,163 certificates observed across 376,928,781 graded domains (61.4% of graded domains presented a certificate).

How long ago did these certificates expire?

Here is the full breakdown, measured at the instant each domain was scanned:

Read the table bottom-up and a lifecycle appears. The 1–30 day bucket is the churn zone: certificates in mid-lapse that will mostly get renewed once someone notices the warning, plus a steady inflow of sites beginning their slide into neglect. The 31–365 day band is where notice stops happening. Past one year, renewal essentially never comes; the site has exited maintenance and entered decay. The over-five-year cohort is the fossil record.

The proportions tell you which regime dominates. If the expired population were mostly operational error, the buckets would shrink as they age. Instead the 1–5 year bucket alone (1,726,616) is nearly four times the size of the 1–30 day bucket (458,612). Abandonment, not accident, is the main supplier of expired certificates on the live web.

What does an expired certificate actually do to visitors?

As industry context rather than census data: every major browser responds to an expired certificate with a full-page interstitial warning — the “Your connection is not private” screen, typically citing an error like NET::ERR_CERT_DATE_INVALID. On most sites a visitor can click through it. On sites that sent an HSTS header while the certificate was still valid, the browser removes the click-through option entirely; the site is simply unreachable until the certificate is fixed.

So the 5.16 million sites in this report are, from a visitor’s perspective, somewhere between alarming and gone. Each one trains its remaining visitors to do one of two things: leave, or click through a security warning. The second habit is the more corrosive one. A web where millions of live sites throw certificate warnings as a matter of course teaches people that certificate warnings are noise. That lesson transfers directly to the one time the warning matters — an actual man-in-the-middle attack presents to the user exactly the way a lapsed renewal does.

There is a second cost that has nothing to do with browsers. An expired certificate is a public, machine-readable statement that nobody is maintaining the endpoint. Attackers scanning for soft targets read it the same way we do: whoever ran this stopped looking. The certificate is rarely the vulnerability; it is the tell.

Why do expired certificates pile up?

The economics of the modern certificate ecosystem make the year-plus cohort easy to explain. Certificates today are free and automatable — has anyone been billed for basic domain validation since Let’s Encrypt normalised free issuance? The binding constraint is not money, it is attention. A certificate renews forever if automation is set up once, and lapses forever if it is not and the owner moves on.

That means the expired population is largely a census of organisational events, not technical ones. Projects end. Companies fold or get acquired. The one person who knew about the server leaves. Marketing microsites outlive their campaigns by half a decade. The hosting keeps auto-billing, the server keeps answering, and the certificate — the only component with a built-in clock — is the part that visibly rots first.

That framing also explains the shape of our data. The 8.9% fresh-lapse share is roughly the steady-state error rate of a web that has mostly automated renewal: small, constantly replenished, constantly draining as fixes land. Everything past it is inventory that stopped moving.

Worth stating clearly: fixing this specific failure costs nothing. Modern certificates are free and renewal is a solved automation problem. For the 458,612 sites in the fresh-lapse bucket, the barrier is awareness, not cost. For the 2.47 million in the year-plus cohort, the honest fix is often a different one — decide whether the site should exist at all, and if not, switch it off rather than letting it decay in public.

How does this compare with other certificate problems?

Expiry is one failure mode among several. In the same census round, of 231,455,163 domains presenting a certificate, some presented a self-signed certificate, and millions of certificates showed some form of issue — untrusted chains, hostname mismatches and expiry among them. Expired-but-otherwise-real certificates occupy a distinctive niche in that landscape: unlike a self-signed certificate, which usually never worked for public visitors, an expired one is evidence the site used to be maintained. It is the failure mode of decline, not of misconfiguration.

We cover the neighbouring failure modes in depth elsewhere — see the certificate error report for the full taxonomy, and the internet’s dead domains for what happens after decay completes and the site stops answering at all. This report sits between those two: the domains here are alive enough to serve, and neglected enough that their own credentials have lapsed.

How we measured this

Method. During the August 2026 census round (figures as of 2026-08-16, methodology v9), we attempted TLS connections to every graded domain and recorded the leaf certificate each live site presented. Each certificate’s notAfter validity date was compared against the capture timestamp and bucketed: still valid, expired 1–30 days, 31–365 days, 1–5 years, or more than 5 years.

Denominator. 231,455,163 certificates observed, one per graded domain that completed a TLS handshake and presented a certificate. The wider graded population was 376,928,781 domains, so 61.4% of graded domains presented a certificate; the rest served no HTTPS or no responsive web endpoint at all. All percentages in this article use the 231,455,163 certificates-observed denominator unless stated otherwise.

Vantage. Single measurement infrastructure, EU-based. We record what a generic client is served; a site presenting different certificates to different regions or SNI configurations is represented by what our client saw.

The capture-instant caveat, which matters here more than in most of our reports. Expiry status is a property of a moment, not of a domain. Every figure above is the state at the instant that domain was scanned during the August 2026 round. A certificate renewed the next day still counts as expired here; one that lapsed the day after we passed counts as valid. The 1–30 day bucket in particular is a snapshot of a churning population, not a stable cohort. The multi-year buckets are far more stable — a certificate five years expired at capture was, with near certainty, also expired the month before and the month after — which is why we lean on them for the abandonment claim.

What this does not measure. We measure the presented leaf certificate’s validity window only. We make no claim about whether an individual site is actually abandoned, who operates it, or why its certificate lapsed; the abandonment framing is a population-level inference from the age distribution. Browser-behaviour descriptions (interstitials, HSTS non-bypass) are industry knowledge, not census measurements.

Aggregate only. We never name, grade, or publish data about an individual registrant’s domain. Data is stored and processed within the EU.

FAQ

How many websites have an expired SSL certificate? In our August 2026 census of the live web, 5,157,928 sites — 2.23% of the 231,455,163 live domains that presented a TLS certificate — were serving one that had already expired at the moment we scanned them. That is roughly one certificate in every 45.

Is an expired certificate a security risk? The expired date itself does not break the encryption of an existing connection, but browsers treat it as untrustworthy and show a full-page warning, because an expired certificate can no longer be reliably checked for revocation and signals an unmaintained endpoint. The larger risk is the habit it builds: sites that make visitors click through warnings train them to click through the same warning during a real attack.

Do expired certificates mean the website is abandoned? Not individually — a fresh lapse is often just a failed renewal. But the age distribution says abandonment dominates the population: 91.1% of the expired certificates we observed had been expired more than 30 days, and 47.8% (2,466,978 certificates) more than a year. A certificate that has been expired for years on a server that still answers is a strong population-level signal that nobody is maintaining the site.

How long does it take to fix an expired certificate? Minutes, and typically for free — modern automated issuance renews certificates without human involvement once configured. That is what makes the 2.47 million year-plus cohort notable: the fix has been effectively free the entire time. Our guide to fixing an expired SSL certificate walks through it.

Why does my browser say “your connection is not private”? An expired certificate is one of the most common triggers for that screen, alongside hostname mismatches and untrusted issuers. Given that 5.16 million live sites were serving expired certificates at our August 2026 capture, encountering the warning in the wild is routine. We break down the full error family in Your connection is not private.

What should I do if my certificate has expired? Renew it immediately — the process is free and takes minutes with any modern hosting provider or certificate automation tool. If your hosting supports automatic renewal (most do), enable it now so this cannot recur. If you use a manual workflow, set a calendar reminder 30 days before your next expiry date. For sites in the year-plus expired cohort, the honest question is whether the site should still exist: if it should, fix the certificate; if it should not, take it offline rather than leaving it decaying in public and training your remaining visitors to ignore security warnings.

How does this compare to the July 2026 census? The July 2026 round was our prior census measurement. The structural pattern — the 1–30 day bucket as a steady churn rate, the year-plus cohort as the dominant mass — is consistent across rounds, because the abandonment dynamic that produces it is continuous, not episodic. Month-to-month count changes reflect the natural turnover of the domain population, registrations and deletions, and the slow drainage of the fresh-lapse bucket as owners notice warnings. The 2.47 million year-plus cohort is the stable signal: those sites are not going to be fixed. We will track whether the share of expired certificates grows as a proportion of the total, which would indicate automation adoption is not keeping pace with domain registration rates.

Why does this matter for e-commerce and SaaS businesses in particular? An expired certificate on any customer-facing endpoint costs you conversions immediately and trust permanently. The “Your connection is not private” interstitial stops most users cold — they do not proceed, they leave. For any business where a website is a revenue channel, a lapsed certificate is a revenue event, not just a maintenance task. Beyond the direct visitor impact, an expired certificate on an API endpoint or webhook receiver breaks integrations silently: the partner’s client sees a TLS error, the request fails, and the debugging trail is cold by the time anyone notices. Certificate monitoring — knowing your expiry dates before your customers do — is a five-minute setup with free tooling.

What this means for IT managers, security teams, and business owners

The 5.16 million expired certificates in this report are not a collective technical failure — they are the predictable output of a web where automation is optional and site abandonment is common. For the organisations and individuals who can act, the practical implications are straightforward and mostly cheap to address.

For IT managers and security teams, the operational priority is visibility. You cannot renew a certificate you do not know about. A certificate inventory — a simple list of every domain your organisation operates, when each certificate expires, and whether renewal is automated — eliminates almost all operational certificate failures. Most expired certificates in the fresh-lapse bucket (the 458,612 sites expired within 30 days) are purely awareness failures: the right person was not watching the right thing. Automated monitoring that alerts before expiry, not after, is the fix. If your organisation has more than a handful of domains, a certificate management tool or a simple cron job checking expiry dates is worth more than most security tooling costing ten times as much.

For security teams specifically, the habit angle is the long-term risk. Each of the 5.16 million sites with an expired certificate is teaching its visitors to dismiss security warnings. That habituation affects the same users who visit your systems. A user who has clicked through ten certificate warnings in the past month is a weaker link in your security chain than one who has never seen the screen at all. The population-level cost of expired certificates is not just on the sites serving them — it is on every user whose threshold for trusting a warning gets lowered by repeated false alarms.

For business owners, the message is simple: check your domain today. An expired certificate is the most publicly visible security failure a website can have, and one of the cheapest to fix. If you are not certain your certificate renewal is automated, assume it is not — then confirm with whoever hosts your site. The year-plus expired cohort in this report is not made up of negligent operators; most of those sites are simply forgotten. Make sure yours is not.

Data to cite

“5,157,928 live websites were serving an expired TLS certificate in the August 2026 census — 2.23% of all certificate-presenting domains observed, or approximately one in every 45 live sites.” — defaults.exposed August 2026 Domain Security Census (432M domains)

“91.1% of expired TLS certificates observed in the August 2026 census had been expired for more than 30 days, confirming that most expired certificates are not fresh renewal failures but the result of sustained neglect.” — defaults.exposed August 2026 Domain Security Census (432M domains)

“2,466,978 live websites — 47.8% of all expired certificate cases — had certificates that lapsed more than a year before the August 2026 census measurement, a figure that indicates organisational abandonment rather than operational error as the dominant cause.” — defaults.exposed August 2026 Domain Security Census (432M domains)

“740,362 live websites were serving a TLS certificate that had expired more than five years ago at the time of the August 2026 census sweep — sites still switched on, still billing for hosting, still presenting a full-page browser warning to every visitor.” — defaults.exposed August 2026 Domain Security Census (432M domains)

“Approximately 1 in every 45 certificates presented by a live, responding website in the August 2026 census was already expired at the moment of measurement.” — defaults.exposed August 2026 Domain Security Census (432M domains)

“Only 8.9% of expired TLS certificates observed in the August 2026 census had lapsed within the previous 30 days — meaning the fresh-renewal-failure rate is a small fraction of the total expired population, which is dominated by long-lapsed certificates.” — defaults.exposed August 2026 Domain Security Census (432M domains)

Check your domain free at defaults.exposed — see exactly how your domain scores on TLS certificate validity, expiry status, and 31 other externally observable security checks. Takes 30 seconds. No account needed. Read the full State of Domain Security 2026 report →

Aggregate data only. Data stored and processed in the EU.

How to cite this report

Press / blog: defaults.exposed (2026). Expired SSL Certificates: 5.2 Million Sites Still Serving. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/expired-certificates-still-serving

Academic: defaults.exposed. (2026, August 18). Expired SSL Certificates: 5.2 Million Sites Still Serving. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/expired-certificates-still-serving

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=231,455,163 certificates)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026