~/dnsniffer/issuers/fastest-declining
CAs losing ground
Certificate authorities ranked by decline in the number of domains they secure, measured . Cloudflare is down 56.83% over 90 days.
20 CAs
- 2,423 active▼ -56.83%-3,190 domains
- 3,872 active▼ -33.98%-1,993 domains
- 21,367 active▼ -33.45%-10,742 domains
- 4,408 active▼ -26.42%-1,583 domains
- 1,038 active▼ -24.78%-342 domains
- 43,488 active▼ -23.64%-13,460 domains
- 9,551,684 active▼ -18.12%-2,113,376 domains
- 2,145 active▼ -17.47%-454 domains
- 2,458 active▼ -16.48%-485 domains
- 1,419 active▼ -12.78%-208 domains
- 10,072 active▼ -10.22%-1,147 domains
- 12D-Trust1,939 active▼ -9.18%-196 domains
- 13home.pl143,977 active▼ -7.96%-12,456 domains
- 23,498 active▼ -5.73%-1,429 domains
- 24,666 active▼ -4.52%-1,168 domains
- 16Entrust1,946 active▼ -3.71%-75 domains
- 1,950 active▼ -2.65%-53 domains
- 18Actalis1,050,398 active▼ -2.56%-27,542 domains
- 3,547 active▼ -0.84%-30 domains
- 20ZeroSSL1,883,782 active▼ -0.50%-9,498 domains
# CAs securing fewer than 1,000 active domains are excluded - percentage change on a handful of domains is noise, not a trend. Direction is shown as ▲/▼ and a signed number as well as colour. Baselines older than 31 August 2026 are estimated, not measured - see the note below the board.
- ? Which certificate authority is losing the most market share?
- Cloudflare, down 56.83% over the last 90 days (-3,190 domains) to 2,423 domains secured as of October 15, 2026.
- ? What makes a CA decline in this ranking?
- Two things: domains moving to another certificate authority, and domains going away entirely. Each domain counts once, under its most recent issuer, so a CA loses ground here when the domains it used to cover stop pointing at it - most often because a host switched its default issuer, or because an intermediate was rotated out.
- ? Why are small CAs excluded from this ranking?
- Percentage change on a handful of domains is noise. We only rank certificate authorities securing at least 1,000 active domains.
- ? Why is this board empty?
- Daily measurement started on 31 August 2026. The history before that date is reconstructed from certificate first-seen dates, and that reconstruction can only ever grow - a domain that switched away from a CA is credited to its current CA for its whole history, so no CA can appear to shrink in it. This board fills in as measured snapshots accumulate and a real decline becomes visible.