Download websites that use OpenSSL

About OpenSSL

Almost everything else in this dataset is detected because a site chose to publish it. OpenSSL is different, because it usually appears only when a server volunteers information it did not have to send. A response header that names the cryptographic library, and sometimes its exact build, is a configuration detail rather than a design decision, and it survives on the public internet mostly through inattention. Any analysis built on this row has to start from that fact, because the population is not sites that use the library. The population is sites that disclose it.

The distinction is large. The library sits underneath a very large share of internet infrastructure, inside web servers, mail servers, language runtimes, load balancers, databases and appliances, so the true usage figure is unreachable from the outside by an enormous margin. As of September 2026 we detect it on 1,158,641 sites, and that number should be read as the disclosing subset. Servers configured to suppress version banners, or fronted by a proxy that rewrites headers, are absent by construction, and those are disproportionately the professionally administered ones.

The disclosing subset is still valuable, and it is valuable precisely because of what disclosure correlates with. A server still advertising its cryptographic library tends to be a server that was set up once and left alone. Version evidence supports that reading. Across the sites where a version is readable we record 218 distinct strings, and the one we log most often is 1.0.2k, a release from an era of the software that ended years ago. A long tail of ageing builds is the normal state of infrastructure that nobody owns.

Here the caveats have to be stated firmly, because this is the place where a dataset is most easily misused. A version string is not a vulnerability assessment. Enterprise distributions backport security fixes while keeping the original version number, so a build that looks ancient may be fully patched, and the banner will never say so. The reported string may also come from a compiled default rather than the running library. Anyone treating these values as a target list is doing something both technically wrong and ethically indefensible. The legitimate uses are inventory, fleet management, research and vendor risk assessment, which all depend on knowing what your own estate or your own suppliers expose.

Read that way, the file answers questions that per-domain checks cannot. A security researcher asking how quickly the web retires old cryptographic builds needs a population and repeated observations, not a single response. A hosting provider auditing its own address space needs every site it operates, not the ones that already generated a complaint. A procurement team assessing suppliers needs the whole vendor list checked at once. Filtering by country, where United States accounts for 268,280, or by suffix, where .com is the one we record most often, scopes any of those to the estate that actually concerns you.

Context helps too. Maintained by the OpenSSL Project under the Apache 2.0 licence and available since 1998, the library has outlasted most of the software built on top of it, which is why its version history is one of the better available proxies for how long a given server has been running untouched.