Download websites that use AWS Certificate Manager

About AWS Certificate Manager

A certificate is normally read as proof of identity. The one this service issues is better read as proof of a supplier relationship. AWS Certificate Manager says nothing about the business behind the domain, its size, its market, or anything in its stack above the transport layer. What the certificate does say is that the operator holds an account with a particular cloud vendor and has handed issuance and renewal to it.

AWS Certificate Manager is in our SSL/TLS certificate authorities category, comes from Amazon Web Services, and has been issuing public certificates since 2016. The service exists to take certificate renewal off the list of things an operations team can forget, and the vendor presents it as a way to obtain certificates for its own integrated services and for hybrid and multicloud workloads alike. Breadth of that kind is what bounds the signal. A site presenting one of these certificates is a customer of the cloud vendor, but the endpoint the browser talks to can be a load balancer, a content delivery distribution or an application gateway inside that account, and it can equally be a container or an on-premises host somewhere else.

As of October 2026 the certificate appears on 1,785,292 sites. United States contributes 1,309,070, and .com runs through the footprint, which is roughly what a cloud platform looks like when it sells globally and bills in one currency. Geographic readings need care with any cloud service, because the country we attribute belongs to the site and its audience, not to the region the workload runs in.

For a researcher the practical value of this marker is that it partitions the web by infrastructure rather than by intent. Cloud vendors and their partners use it to find accounts already committed to a competitor. Security and compliance teams use it as a proxy for where issuance and renewal have been centralised, which matters when the question is who would have to act if a certificate had to be replaced in a hurry. Vendors selling anything that terminates encryption themselves, from delivery networks to application firewalls to reverse proxies, read the same marker as a sign that certificate handling is already automated inside a rival platform.

The detection has limits worth stating plainly. Issuer data is only visible where we complete a handshake with the origin the domain actually points at, so a site sitting behind a third-party proxy presents that proxy's certificate and the managed one underneath stays invisible. Sites using the service for internal or private endpoints never expose it publicly. Undercounting is the direction of the error here, and its size is not something anyone can measure from outside the account.

Per-domain lookups are the wrong shape of tool for this question. Knowing that one domain presents a certificate from this issuer is trivia. Knowing how many sites in a country, a domain ending, an industry segment, or a competitor's published customer list share that property is a market map, and building one requires the full export. Change over time works the same way. Two files compared across quarters show migration into and out of the platform at population scale, which is the kind of evidence that survives contact with a sceptical audience. A lookup box can confirm a hunch, but only a population file can support a number you have to defend.