# List of major websites with LE certificate?

**URL:** <https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477>\
**Category:** Help\
**Created:** [June 9, 2021, 8:13pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477 "2021-06-09T20:13:51Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![ghen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ghen/32/49729_2.png) [@ghen](https://community.letsencrypt.org/u/ghen)\
**Post date:** [June 9, 2021, 8:13pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/1 "2021-06-09T20:13:51Z")

</div>

Hi

Just to estimate the magnitude of impact on end-users with older MacOS / iOS versions when DST Root X3 expires (and for whom the Android workaround won't help), is there a list somewhere of _ **major** _ websites that are using Let's Encrypt certificates? Like Wikipedia etc.

If significant portions of the Internet become unusable for those clients, they will be less likely to blame (smaller) individual LE certified websites. Or at least those smaller site owners can tell them "please test Wikipedia as well" to convince customers the issue is on their side.

Found in this topic:

- [Wikipedia](https://www.wikipedia.org/) (multi-CA setup, [see below](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/15))
- [StackOverflow](https://stackoverflow.com/)
- [Mozilla](https://www.mozilla.org/)
- [SourceForge](https://sourceforge.net/)
- [USA Today](https://www.usatoday.com/)
- [Reuters](https://www.reuters.com/)
- [The Sun](https://www.thesun.co.uk/)
- [NBA](https://www.nba.com/)
- [Nature](https://www.nature.com/)
- [Stanford University](https://www.stanford.edu/)
- [National Security Agency](https://www.nsa.gov/)
- ...

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [June 9, 2021, 9:38pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/2 "2021-06-09T21:38:27Z")

</div>

In case there is no such list...  
Here is a first entry:  
[Stanford University](https://www.stanford.edu/)  
Here is a second entry:  
[National Security Agency (nsa.gov)](https://www.nsa.gov/)

---

<div class="post-metadata">

**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\
**Post date:** [June 9, 2021, 10:26pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/4 "2021-06-09T22:26:10Z")

</div>

Looks like this might be relevant:  
[https://trends.builtwith.com/websitelist/LetsEncrypt](https://trends.builtwith.com/websitelist/LetsEncrypt)

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [June 9, 2021, 10:35pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/5 "2021-06-09T22:35:43Z")

</div>

Let's Encrypt has around 200 _million_ unexpired certificates, among around 80 _million_ registered domains.

> **[Let's Encrypt Stats - Let's Encrypt](https://letsencrypt.org/stats/)**
>
> Let's Encrypt Growth Percentage of Web Pages Loaded by Firefox Using HTTPS (14-day moving average, source: Firefox Telemetry)
> Let's Encrypt Certificates Issued Per Day

Let's Encrypt issues more than two-thirds of all certificates issued on any given day.

[https://ct.cloudflare.com/](https://ct.cloudflare.com/)

A list of sites that _don't_ use Let's Encrypt might be shorter. 🙂

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [June 9, 2021, 11:48pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/6 "2021-06-09T23:48:44Z")

</div>

updated my first post with the addition of:  
[National Security Agency (nsa.gov)](https://www.nsa.gov/)

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [June 10, 2021, 5:58am UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/7 "2021-06-10T05:58:40Z")

</div>

> [@rg305](#):
>
> Here is a second entry:  
> [National Security Agency (nsa.gov)](https://www.nsa.gov/)

I did not know that! That's just too funny and cool at the same time!

> [@petercooperjr](#):
>
> [https://ct.cloudflare.com/](https://ct.cloudflare.com/)

"Merkle Town" lists Let's Encrypt as the largest "ROOT CERTIFICATE AUTHORITIES", but seeing that LE still chains up to a IdenTrust root by default, is that even correct? Shouldn't that be IdenTrust strictly speaking?

---

<div class="post-metadata">

**Author:** ![ghen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ghen/32/49729_2.png) [@ghen](https://community.letsencrypt.org/u/ghen)\
**Post date:** [June 10, 2021, 6:05am UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/8 "2021-06-10T06:05:36Z")

</div>

> [@petercooperjr](#):
>
> Let's Encrypt issues more than two-thirds of all certificates issued on any given day.

That's not necessarily a correct comparison, given the 90 days lifetime and 60 days renewal cycle, vs. 1 year for most other CA's. You should probably divide that number by a factor of 4 to 6 to get a comparable number.

Also, big corporate-backed websites are more likely to be using an OV/EV certificate rather than a DV.

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [June 10, 2021, 10:56am UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/9 "2021-06-10T10:56:56Z")

</div>

> [@Osiris](#):
>
> but seeing that LE still chains up to a IdenTrust root by default, is that even correct? Shouldn't that be IdenTrust strictly speaking?

Well, it's based on certificate transparency logs, which are primarily for logging leaf certificates. So I'm assuming the statistics would be based on the owner of the leaf-signing intermediate. Or I suppose it might be based on which policy OID is embedded in the leaf, but I suspect that amounts to basically the same thing.

> [@ghen](#):
>
> That's not necessarily a correct comparison, given the 90 days lifetime and 60 days renewal cycle, vs. 1 year for most other CA's. You should probably divide that number by a factor of 4 to 6 to get a comparable number.

Fair enough. Even doing that, though, Let's Encrypt is a pretty big number.

I suppose somebody should do a project (if it hasn't been done already) of looking at the top _x_ websites based on some major list and seeing which CA they each use.

---

<div class="post-metadata">

**Author:** ![Nummer378](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nummer378/32/49862_2.png) [@Nummer378](https://community.letsencrypt.org/u/Nummer378)\
**Post date:** [June 10, 2021, 11:32am UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/10 "2021-06-10T11:32:22Z")

</div>

> [@Osiris](#):
>
> "Merkle Town" lists Let's Encrypt as the largest "ROOT CERTIFICATE AUTHORITIES", but seeing that LE still chains up to a IdenTrust root by default, is that even correct? Shouldn't that be IdenTrust strictly speaking?

The term root ca they use there is probably a misnomer\*, as they're listing company/trademark names, not actual roots. They most likely have internal mapping logic that maps certain issuers to a company, e.g maybe they check the org field of the intermediate issuer(s) and don't even care to what root you chain up. From a "legal" perspective, LE certs are issued by Let's Encrypt under LE CPS, so they do belong to Let's Encrypt, even if they chain up to IdenTrust, so I consider the Cloudflare view to be correct.

\*I believe by using that term they wanted to highlight that they do not list subordinate CA's there, only CA's that own roots.

[You can now argue that LE does not have any root(s), only ISRG and therefore LE is a subordinate CA]

---

<div class="post-metadata">

**Author:** ![ghen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ghen/32/49729_2.png) [@ghen](https://community.letsencrypt.org/u/ghen)\
**Post date:** [June 10, 2021, 11:34am UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/11 "2021-06-10T11:34:35Z")

</div>

> [@petercooperjr](#):
>
> Fair enough. Even doing that, though, Let's Encrypt is a pretty big number.

Yes, that's what I'm looking for. If a significant portion of "the Internet" breaks for those clients, it will be easier for small site owners to deal with, as they won't appear to be the ones to blame.  
But I expect it will be a large number of smaller sites, not the "big" ones, with perhaps Wikipedia as most notable exception. Hence this query.

> [@petercooperjr](#):
>
> I suppose somebody should do a project (if it hasn't been done already) of looking at the top _x_ websites based on some major list and seeing which CA they each use

I'll look into that. Alexa top-100 or something like that.

---

<div class="post-metadata">

**Author:** ![ghen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ghen/32/49729_2.png) [@ghen](https://community.letsencrypt.org/u/ghen)\
**Post date:** [June 10, 2021, 11:57am UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/12 "2021-06-10T11:57:28Z")

</div>

Only the [Alexa top-50](https://www.alexa.com/topsites) is freely available, of which Wikipedia is indeed the only ISRG/Let's Encrypt issued certificate.  
DigiCert dominates the list with 28 sites, followed by GlobalSign with 8.

(I couldn't reach some of the China-based websites in the list.)

But this sample is of course way too small.

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [June 10, 2021, 2:05pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/13 "2021-06-10T14:05:00Z")

</div>

> [@ghen](#):
>
> Only the [Alexa top-50](https://www.alexa.com/topsites) is freely available, of which Wikipedia is indeed the only ISRG/Let's Encrypt issued certificate.

Stack Overflow is on the list at #47, and that looks like a Let's Encrypt cert to me.

---

<div class="post-metadata">

**Author:** ![ghen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ghen/32/49729_2.png) [@ghen](https://community.letsencrypt.org/u/ghen)\
**Post date:** [June 10, 2021, 2:40pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/14 "2021-06-10T14:40:14Z")

</div>

From [this copy of Alexa-1000](https://www.htmlstrip.com/alexa-top-1000-most-visited-websites), I find the following websites with a Let's Encrypt certificate:  
(hopefully I won't get blocked for link spam here 🙂 )

- [stackoverflow.com](http://stackoverflow.com)
- [quora.com](http://quora.com)
- [stackexchange.com](http://stackexchange.com)
- [freepik.com](http://freepik.com)
- [onlinevideoconverter.com](http://onlinevideoconverter.com)
- [steampowered.com](http://steampowered.com)
- [wikihow.com](http://wikihow.com)
- [instructure.com](http://instructure.com)
- mega.nz
- [scribd.com](http://scribd.com)
- [mozilla.org](http://mozilla.org)
- [abs-cbn.com](http://abs-cbn.com)
- [shopify.com](http://shopify.com)
- [rutracker.org](http://rutracker.org)
- [sex.com](http://sex.com)
- [patch.com](http://patch.com)
- [slickdeals.net](http://slickdeals.net)
- [gamespot.com](http://gamespot.com)
- [geeksforgeeks.org](http://geeksforgeeks.org)
- divar.ir
- rarbg.to
- [sourceforge.net](http://sourceforge.net)
- [elpais.com](http://elpais.com)
- [usatoday.com](http://usatoday.com)
- [thesaurus.com](http://thesaurus.com)
- [pikabu.ru](http://pikabu.ru)
- [crptgate.com](http://crptgate.com)
- [webmd.com](http://webmd.com)
- [hatenablog.com](http://hatenablog.com)
- [discogs.com](http://discogs.com)
- [pornhublive.com](http://pornhublive.com)
- [naukri.com](http://naukri.com)
- [telewebion.com](http://telewebion.com)
- [hotels.com](http://hotels.com)
- [as.com](http://as.com)
- seznam.cz
- nyaa.si
- [chess.com](http://chess.com)
- [reuters.com](http://reuters.com)
- [infobae.com](http://infobae.com)
- [mileroticos.com](http://mileroticos.com)
- [thesun.co.uk](http://thesun.co.uk)
- [hotnewhiphop.com](http://hotnewhiphop.com)
- [yespornplease.com](http://yespornplease.com)
- in.gr
- [investopedia.com](http://investopedia.com)
- [nba.com](http://nba.com)
- [techradar.com](http://techradar.com)
- [canalrcn.com](http://canalrcn.com)
- shopee.tw
- hurriyet.com.tr
- [nownews.com](http://nownews.com)
- [flaticon.com](http://flaticon.com)
- [nature.com](http://nature.com)
- legit.ng
- [superuser.com](http://superuser.com)
- [lifewire.com](http://lifewire.com)
- corriere.it
- [rarbgprx.org](http://rarbgprx.org)
- [chron.com](http://chron.com)
- sci-hub.tw
- cryptobrowser.site
- [news18.com](http://news18.com)
- [kayak.com](http://kayak.com)
- [nypost.com](http://nypost.com)
- [moneycontrol.com](http://moneycontrol.com)
- shopee.co.id
- harvard.edu
- [wayfair.com](http://wayfair.com)
- [propdfconverter.com](http://propdfconverter.com)
- milliyet.com.tr
- [mptentry.com](http://mptentry.com)
- [pcgamer.com](http://pcgamer.com)
- [dictionary.com](http://dictionary.com)
- prom.ua
- [yaplakal.com](http://yaplakal.com)
- [makeuseof.com](http://makeuseof.com)
- [socialblade.com](http://socialblade.com)
- [gamib.com](http://gamib.com)

Strangely, this time Wikipedia came out with a DigiCert certificate instead of Let's Encrypt (repeatedly). Are they using different certificates on different load balancer endpoints or something like that?

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [June 10, 2021, 2:56pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/15 "2021-06-10T14:56:40Z")

</div>

> [@ghen](#):
>
> Strangely, this time Wikipedia came out with a DigiCert certificate instead of Let's Encrypt (repeatedly). Are they using different certificates on different load balancer endpoints or something like that?

Looks like it.

> **[crt.sh | wikipedia.org](https://crt.sh/?Identity=wikipedia.org&exclude=expired)**
>
> Free CT Log Certificate Search Tool from Sectigo (formerly Comodo CA)

[https://wikitech.wikimedia.org/wiki/HTTPS/Unified\_Certificates](https://wikitech.wikimedia.org/wiki/HTTPS/Unified_Certificates)

---

<div class="post-metadata">

**Author:** ![ghen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ghen/32/49729_2.png) [@ghen](https://community.letsencrypt.org/u/ghen)\
**Post date:** [June 10, 2021, 2:59pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/16 "2021-06-10T14:59:05Z")

</div>

Btw, all sites above have R3-issued certificates, no E1 yet. 😉

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [July 10, 2021, 2:59pm UTC](https://community.letsencrypt.org/t/list-of-major-websites-with-le-certificate/153477/17 "2021-07-10T14:59:27Z")

</div>

Closed on July 10, 2021, 2:59pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.