Download websites that use mod_ssl

About mod_ssl

mod_ssl is not something a website chooses. The module is part of how Apache HTTP Server speaks TLS, compiled in or loaded by whoever configured the machine, and the site owner above it usually has no idea the name exists. Which makes it a different kind of signal from a plugin or a platform, and in some ways a more honest one, because nobody adopted it for marketing reasons.

Maintained by the Apache Software Foundation and released under Apache 2.0, the module dates back to 1998, when strong cryptography for the web was still a bolt on rather than a default. Written in C against OpenSSL, mod_ssl gives Apache its certificate handling, cipher configuration and protocol negotiation. Our Web server extensions category is where it sits, though its real role is infrastructural.

As of September 2026 we detect 67,896 sites reporting it, and the version picture is the part worth studying. We record 2.2.34 as the headline version string and count 85 distinct values across the population. A version from a branch that upstream retired long ago, still carried by a substantial part of the base, changes how you read everything else. Long lived server builds do not automatically mean weak cryptography, because distribution vendors backport security fixes without moving the version number, and a machine reporting an old string may be entirely current underneath. But a spread across that many distinct strings tells you the population is not centrally managed, and that patch state has to be inferred rather than assumed.

The country split is the second thing that stands out. Japan carries 13,464 of the detected sites, a distribution that departs from the pattern most technology data in this catalogue follows. A large domestic hosting industry running its own hardware, long service lifetimes and conservative upgrade cycles all push in the same direction, and the result is a national server estate that stays visible for years after other markets have moved behind managed platforms.

Everything above rests on a configuration choice, and that is the caveat that matters most. Apache names its modules in the response header only when the administrator leaves the server tokens setting verbose, and a great many operators cut it back to the product name or strip the header entirely at a proxy. Every hardened server, every site behind a CDN that rewrites its headers, and every distribution that ships a quiet default is invisible to a scan of this kind. The population we report is therefore not the population of Apache TLS deployments, it is the subset that still announces itself, which skews older, less proxied and less hardened than the whole. Stated plainly, this undercounts, and the undercount is not random.

Which is exactly why the file matters more than a lookup. Knowing that one server advertises a given module version answers a support question. Having the full detected population in a downloadable extract, joined to country, domain suffix and the rest of the stack, answers research questions instead. How server estates age, where retired branches persist, which hosting markets keep long lived infrastructure in service, and which segments a patch management, scanning or migration product should be sold into. Questions of that shape need the whole list at once, and they need it as a file you can filter yourself.