10:23 a.m.
no analysis for this month, sorry
SSL/TLS survey of 514491 websites from Alexa's top 1 million
Stats only from connections that did provide valid certificates
(or anonymous DH from servers that do also have valid certificate
installed)
Supported Ciphers Count Percent
-------------------------+---------+-------
3DES 441032 85.722
3DES Only 662 0.1287
AES 506240 98.3963
AES Only 20155 3.9175
AES-CBC 506132 98.3753
AES-CBC Only 9532 1.8527
AES-GCM 372880 72.4755
AES-GCM Only 53 0.0103
CAMELLIA 228600 44.4323
CAMELLIA Only 1 0.0002
CHACHA20 63632 12.368
CHACHA20 Only 1 0.0002
Insecure 64742 12.5837
RC4 231507 44.9973
RC4 Only 1252 0.2433
RC4 Preferred 27685 5.381
RC4 forced in TLS1.1+ 15710 3.0535
x:FF 29 RC4 Only 1532 0.2978
x:FF 29 RC4 Preferred 31430 6.109
x:FF 29 incompatible 137 0.0266
x:FF 35 RC4 Only 1845 0.3586
x:FF 35 RC4 Preferred 31550 6.1323
x:FF 35 incompatible 138 0.0268
y:DHE-RSA-SEED-SHA 86011 16.7177
y:IDEA-CBC-SHA 78923 15.34
y:SEED-SHA 96111 18.6808
z:ADH-AES128-GCM-SHA256 333 0.0647
z:ADH-AES128-SHA 745 0.1448
z:ADH-AES128-SHA256 236 0.0459
z:ADH-AES256-GCM-SHA384 343 0.0667
z:ADH-AES256-SHA 749 0.1456
z:ADH-AES256-SHA256 236 0.0459
z:ADH-CAMELLIA128-SHA 344 0.0669
z:ADH-CAMELLIA256-SHA 350 0.068
z:ADH-DES-CBC-SHA 321 0.0624
z:ADH-DES-CBC3-SHA 759 0.1475
z:ADH-RC4-MD5 621 0.1207
z:ADH-SEED-SHA 272 0.0529
z:AECDH-AES128-SHA 12374 2.4051
z:AECDH-AES256-SHA 12403 2.4107
z:AECDH-DES-CBC3-SHA 12331 2.3967
z:AECDH-NULL-SHA 55 0.0107
z:AECDH-RC4-SHA 11656 2.2655
z:DES-CBC-MD5 12201 2.3715
z:DES-CBC-SHA 37676 7.323
z:DES-CBC3-MD5 24906 4.8409
z:ECDHE-RSA-NULL-SHA 59 0.0115
z:EDH-RSA-DES-CBC-SHA 32341 6.286
z:EXP-ADH-DES-CBC-SHA 225 0.0437
z:EXP-ADH-RC4-MD5 222 0.0431
z:EXP-DES-CBC-SHA 16253 3.159
z:EXP-EDH-RSA-DES-CBC-SHA 13136 2.5532
z:EXP-RC2-CBC-MD5 19785 3.8455
z:EXP-RC4-MD5 20799 4.0426
z:EXP1024-DES-CBC-SHA 5124 0.9959
z:EXP1024-RC4-SHA 5211 1.0128
z:IDEA-CBC-MD5 2368 0.4603
z:NULL-MD5 228 0.0443
z:NULL-SHA 231 0.0449
z:NULL-SHA256 22 0.0043
z:RC2-CBC-MD5 12471 2.4239
z:RC4-64-MD5 1000 0.1944
Cipher ordering Count Percent
-------------------------+---------+-------
Client side 131154 25.492
Server side 383337 74.508
Supported Handshakes Count Percent
-------------------------+---------+-------
ADH 872 0.1695
AECDH 12430 2.416
DHE 282349 54.8793
ECDH 3 0.0006
ECDHE 400761 77.8947
ECDHE and DHE 210872 40.9865
RSA 466026 90.58
Supported PFS Count Percent PFS Percent
-------------------------+---------+--------+-----------
DH,1024bits 176947 34.3926 62.6696
DH,1536bits 1 0.0002 0.0004
DH,2048bits 97579 18.9661 34.5597
DH,2236bits 10 0.0019 0.0035
DH,2560bits 1 0.0002 0.0004
DH,3072bits 1027 0.1996 0.3637
DH,3092bits 1 0.0002 0.0004
DH,4096bits 6303 1.2251 2.2323
DH,512bits 53 0.0103 0.0188
DH,768bits 502 0.0976 0.1778
DH,8192bits 1 0.0002 0.0004
ECDH,B-163,163bits 1 0.0002 0.0002
ECDH,B-571,570bits 1514 0.2943 0.3778
ECDH,K-163,163bits 1 0.0002 0.0002
ECDH,K-571,570bits 1 0.0002 0.0002
ECDH,P-192,192bits 2 0.0004 0.0005
ECDH,P-224,224bits 89 0.0173 0.0222
ECDH,P-256,256bits 389270 75.6612 97.1327
ECDH,P-384,384bits 2668 0.5186 0.6657
ECDH,P-521,521bits 8073 1.5691 2.0144
Prefer DH,1024bits 63712 12.3835 22.565
Prefer DH,1536bits 1 0.0002 0.0004
Prefer DH,2048bits 9342 1.8158 3.3087
Prefer DH,2236bits 1 0.0002 0.0004
Prefer DH,3072bits 14 0.0027 0.005
Prefer DH,4096bits 342 0.0665 0.1211
Prefer DH,768bits 102 0.0198 0.0361
Prefer ECDH,B-163,163bits 1 0.0002 0.0002
Prefer ECDH,B-571,570bits 1305 0.2536 0.3256
Prefer ECDH,K-163,163bits 1 0.0002 0.0002
Prefer ECDH,K-571,570bits 1 0.0002 0.0002
Prefer ECDH,P-224,224bits 55 0.0107 0.0137
Prefer ECDH,P-256,256bits 337269 65.5539 84.1571
Prefer ECDH,P-384,384bits 2525 0.4908 0.6301
Prefer ECDH,P-521,521bits 7266 1.4123 1.8131
Prefer PFS 421937 82.0106 0
Support PFS 472238 91.7874 0
Supported ECC curves Count Percent
-------------------------+---------+--------
brainpoolP256r1 1285 0.2498
brainpoolP384r1 1285 0.2498
brainpoolP512r1 1285 0.2498
prime192v1 1409 0.2739
prime256v1 399379 77.626
prime256v1 Only 346484 67.345
secp160k1 1372 0.2667
secp160r1 1376 0.2674
secp160r2 1372 0.2667
secp192k1 1393 0.2708
secp224k1 1466 0.2849
secp224r1 3478 0.676
secp224r1 Only 2 0.0004
secp256k1 2664 0.5178
secp384r1 53002 10.3018
secp384r1 Only 342 0.0665
secp521r1 22491 4.3715
secp521r1 Only 118 0.0229
sect163k1 1376 0.2674
sect163k1 Only 2 0.0004
sect163r1 1374 0.2671
sect163r2 1375 0.2673
sect163r2 Only 1 0.0002
sect193r1 1374 0.2671
sect193r2 1374 0.2671
sect233k1 1460 0.2838
sect233r1 1458 0.2834
sect239k1 1458 0.2834
sect283k1 2637 0.5125
sect283r1 2637 0.5125
sect409k1 2637 0.5125
sect409r1 2637 0.5125
sect571k1 2650 0.5151
sect571r1 2650 0.5151
Unsupported curve fallback Count Percent
------------------------------+---------+--------
False 69342 13.4778
True 279091 54.246
order-specific 247 0.048
unknown 165811 32.2282
ECC curve ordering Count Percent
-------------------------+---------+--------
client 4128 0.8023
inconclusive-noecc 10 0.0019
server 395723 76.9154
unknown 114630 22.2803
TLSv1.2 PFS supported sigalgs Count Percent
------------------------------+---------+--------
ECDSA-SHA1 36846 7.1616
ECDSA-SHA1 Only 3 0.0006
ECDSA-SHA224 36847 7.1618
ECDSA-SHA256 36861 7.1646
ECDSA-SHA384 36862 7.1648
ECDSA-SHA512 36877 7.1677
ECDSA-SHA512 Only 15 0.0029
RSA-MD5 169404 32.9265
RSA-SHA1 349277 67.8879
RSA-SHA1 Only 46373 9.0134
RSA-SHA224 283789 55.1592
RSA-SHA256 309288 60.1153
RSA-SHA256 Only 5302 1.0305
RSA-SHA384 284974 55.3895
RSA-SHA384 Only 1 0.0002
RSA-SHA512 285175 55.4286
RSA-SHA512 Only 218 0.0424
TLSv1.2 PFS ordering Count Percent
------------------------------+---------+--------
client 247485 48.1029
indeterminate 113 0.022
intolerant 3917 0.7613
order-fallback 6 0.0012
server 141461 27.4953
unsupported 22160 4.3072
TLSv1.2 PFS sigalg fallback Count Percent
------------------------------+---------+--------
ECDSA SHA1 36832 7.1589
ECDSA intolerant 63 0.0122
ECDSA pfs-rsa-SHA512 1 0.0002
RSA False 168019 32.6573
RSA SHA1 154614 30.0518
RSA intolerant 32671 6.3502
RSA pfs-ecdsa-SHA512 1 0.0002
RSA soft-nopfs 1437 0.2793
Renegotiation Count Percent
-------------------------+---------+--------
False 6340 1.2323
insecure 19961 3.8798
secure 488190 94.888
Compression Count Percent
-------------------------+---------+--------
1 (zlib compression) 10392 2.0199
False 6340 1.2323
NONE 497759 96.7479
TLS session ticket hint Count Percent
-------------------------+---------+--------
1 4 0.0008
1 only 4 0.0008
2 2 0.0004
2 only 2 0.0004
5 1 0.0002
5 only 1 0.0002
10 7 0.0014
10 only 7 0.0014
15 8 0.0016
15 only 8 0.0016
30 11 0.0021
30 only 10 0.0019
60 93 0.0181
60 only 87 0.0169
65 1 0.0002
65 only 1 0.0002
70 7 0.0014
100 14 0.0027
100 only 14 0.0027
120 30 0.0058
120 only 30 0.0058
128 2 0.0004
128 only 2 0.0004
150 2 0.0004
180 39 0.0076
180 only 37 0.0072
240 14 0.0027
240 only 14 0.0027
300 232702 45.2296
300 only 227970 44.3098
302 2 0.0004
302 only 2 0.0004
360 2 0.0004
360 only 1 0.0002
400 7 0.0014
400 only 7 0.0014
420 113 0.022
420 only 87 0.0169
480 11 0.0021
480 only 11 0.0021
500 4 0.0008
500 only 4 0.0008
540 1 0.0002
540 only 1 0.0002
600 24187 4.7012
600 only 24031 4.6708
720 2 0.0004
720 only 2 0.0004
840 2 0.0004
840 only 2 0.0004
900 718 0.1396
900 only 702 0.1364
960 3 0.0006
960 only 3 0.0006
1200 2085 0.4053
1200 only 2080 0.4043
1320 1 0.0002
1320 only 1 0.0002
1500 11 0.0021
1500 only 10 0.0019
1800 473 0.0919
1800 only 468 0.091
2100 1 0.0002
2100 only 1 0.0002
2400 6 0.0012
2400 only 6 0.0012
2700 7 0.0014
2700 only 7 0.0014
3000 19 0.0037
3000 only 19 0.0037
3600 512 0.0995
3600 only 498 0.0968
3900 1 0.0002
3900 only 1 0.0002
4200 1 0.0002
5160 1 0.0002
5160 only 1 0.0002
5400 14 0.0027
5400 only 6 0.0012
6000 3 0.0006
6000 only 3 0.0006
7200 16177 3.1443
7200 only 16154 3.1398
10800 2416 0.4696
10800 only 2411 0.4686
14400 70 0.0136
14400 only 70 0.0136
18000 7 0.0014
18000 only 7 0.0014
21600 4966 0.9652
21600 only 4963 0.9646
28800 2049 0.3983
28800 only 637 0.1238
36000 1187 0.2307
36000 only 1176 0.2286
43200 35 0.0068
43200 only 35 0.0068
60000 1 0.0002
60000 only 1 0.0002
64800 51944 10.0962
64800 only 51911 10.0898
72000 13 0.0025
72000 only 13 0.0025
86000 31 0.006
86000 only 31 0.006
86400 3546 0.6892
86400 only 3543 0.6886
100800 11273 2.1911
100800 only 11263 2.1892
129600 9 0.0017
129600 only 9 0.0017
172800 7 0.0014
172800 only 7 0.0014
216000 1 0.0002
216000 only 1 0.0002
432000 2 0.0004
432000 only 2 0.0004
604800 1 0.0002
604800 only 1 0.0002
864000 3 0.0006
864000 only 3 0.0006
2592000 1 0.0002
2592000 only 1 0.0002
None 166108 32.2859
None only 159631 31.027
Certificate sig alg Count Percent
-------------------------+---------+--------
None 13099 2.546
ecdsa-with-SHA256 36858 7.164
sha1WithRSAEncryption 100797 19.5916
sha256WithRSAEncryption 377291 73.3329
sha384WithRSAEncryption 6 0.0012
sha512WithRSAEncryption 26 0.0051
Certificate key size Count Percent
-------------------------+---------+--------
ECDSA 256 36891 7.1704
ECDSA 384 8 0.0016
RSA 1024 68 0.0132
RSA 10240 5 0.001
RSA 2048 459006 89.2156
RSA 2049 3 0.0006
RSA 2056 2 0.0004
RSA 2058 2 0.0004
RSA 2064 1 0.0002
RSA 2078 1 0.0002
RSA 2080 2 0.0004
RSA 2084 6 0.0012
RSA 2096 2 0.0004
RSA 2408 1 0.0002
RSA 2432 2 0.0004
RSA 2480 1 0.0002
RSA 2890 1 0.0002
RSA 3024 1 0.0002
RSA 3071 1 0.0002
RSA 3072 119 0.0231
RSA 3248 3 0.0006
RSA 4042 1 0.0002
RSA 4048 1 0.0002
RSA 4056 26 0.0051
RSA 4069 2 0.0004
RSA 4092 6 0.0012
RSA 4094 1 0.0002
RSA 4096 18374 3.5713
RSA 8192 5 0.001
RSA/ECDSA Dual Stack 44 0.0086
OCSP stapling Count Percent
-------------------------+---------+--------
Supported 110108 21.4013
Unsupported 404383 78.5987
Supported Protocols Count Percent
-------------------------+---------+-------
SSL2 25202 4.8984
SSL2 Only 15 0.0029
SSL3 126817 24.649
SSL3 Only 549 0.1067
SSL3 or TLS1 Only 72846 14.1588
SSL3 or lower Only 571 0.111
TLS1 510753 99.2735
TLS1 Only 43061 8.3696
TLS1 or lower Only 96394 18.7358
TLS1.1 405071 78.7324
TLS1.1 Only 30 0.0058
TLS1.1 or up Only 2939 0.5712
TLS1.2 415131 80.6877
TLS1.2 Only 1267 0.2463
TLS1.2, 1.0 but not 1.1 11078 2.1532
Statistics from 481615 chains provided by 696385 hosts
Server provided chains Count Percent
-------------------------+---------+-------
complete 438491 62.9667
incomplete 20877 2.9979
untrusted 237017 34.0353
Trusted chain statistics
========================
Chain length Count Percent
-------------------------+---------+-------
2 214 0.0444
3 479299 99.5191
4 2064 0.4286
5 38 0.0079
CA key size in chains Count
-------------------------+---------
ECDSA 256 21571
ECDSA 384 21574
RSA 1024 189
RSA 2045 3
RSA 2048 797792
RSA 4096 124027
Chains with CA key Count Percent
-------------------------+---------+-------
ECDSA 256 21571 4.4789
ECDSA 384 21574 4.4795
RSA 1024 187 0.0388
RSA 2045 3 0.0006
RSA 2048 459556 95.4198
RSA 4096 123505 25.6439
Signature algorithm (ex. root) Count
------------------------------+---------
ecdsa-with-SHA384 21569
sha1WithRSAEncryption 87272
sha256WithRSAEncryption 264799
sha384WithRSAEncryption 109831
sha512WithRSAEncryption 70
Eff. host cert chain LoS Count Percent
-------------------------+---------+-------
80 87432 18.1539
112 372602 77.3651
128 21581 4.481
Root CAs Count Percent
---------------------------------------------+---------+-------
(2c543cd1) GeoTrust Global CA 102403 21.2624
(d6325660) COMODO RSA Certification Authority 101866 21.1509
(cbf06781) Go Daddy Root Certificate Authorit 47350 9.8315
(5ad8a5d6) GlobalSign Root CA 41408 8.5977
(b204d74a) VeriSign Class 3 Public Primary Ce 26837 5.5723
(244b5494) DigiCert High Assurance EV Root CA 25125 5.2168
(2e4eed3c) thawte Primary Root CA 22902 4.7553
(eed8c118) COMODO ECC Certification Authority 21557 4.476
(653b494a) Baltimore CyberTrust Root 11908 2.4725
(157753a5) AddTrust External CA Root 10009 2.0782
(ae8153b9) StartCom Certification Authority 8637 1.7933
(fc5a8f99) USERTrust RSA Certification Author 7875 1.6351
(3513523f) DigiCert Global Root CA 7502 1.5577
(4bfab552) Starfield Root Certificate Authori 6246 1.2969
(480720ec) GeoTrust Primary Certification Aut 5252 1.0905
(f387163d) Starfield Technologies, Inc. 4889 1.0151
Scan performed between 18th and 28th of September 2015.
--
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic