Download websites that use Sectigo

About Sectigo

Almost every technology on a website is chosen by someone who works on that website. A certificate authority frequently is not. Sectigo appears in the chain of a site's TLS certificate, and for a large share of the sites carrying it the certificate arrived bundled with a hosting plan, a reseller package or a control panel that issues on the customer's behalf without ever presenting a brand choice.

Detection here is unusually solid, which is worth saying because most stack fingerprinting is inference. Certificate issuance leaves a signed record in the handshake, so a recorded issuer is something the server actually presented rather than something guessed from a script filename. The caveat is of a different kind: we observe the certificate serving a hostname at crawl time, not the contract behind it, and a single commercial account can cover a great many hostnames that belong to other people.

As of September 2026 we count 6,326,357 sites, 2,568,883 of them in Germany, with .com heavily represented in the domain mix. The German weighting repays a moment of thought, because it is not a story about German enthusiasm for a New Jersey certificate authority. European hosting groups resell the brand as their default paid certificate, so the country column is closer to a map of which hosts bundle which authority than to a map of end customer demand.

The business dates to 1998 under an earlier name and was rebranded after a change in ownership, which is why older documentation and some chains still speak of Comodo. Certificate lifetimes have been shortening across the industry, and shorter lifetimes change the commercial character of the install base. A content management system is chosen once and lives for years. A paid certificate is re-decided on a schedule, and every row on this list has an expiry attached to it.

The offering is Proprietary and sits in our SSL/TLS certificate authorities group, and the commercial logic follows from those two facts. Competing authorities and their resellers want the renewal window and the hosting partners that control it. Enterprise PKI vendors want the accounts large enough to have graduated from manual renewal to certificate management. Attack surface and asset teams want the inverse view, looking for hostnames in their own estate presenting certificates from an authority nobody in the security team selected, which is one of the ordinary ways forgotten infrastructure surfaces.

There is a limit to how far a snapshot can be pushed. A crawl sees the certificate presented for the hostname we asked for, so multi domain and wildcard arrangements are represented by the hostnames we reached rather than by every name on the certificate. Sites behind a delivery network may present that network's certificate instead of the origin's, which removes the issuer from view entirely. Free automated issuance has changed the shape of this market and continues to, so a single snapshot describes a moment rather than a trend.

A per domain check tells you the issuer for one hostname, and a browser will do that at no cost. The dataset answers what a single lookup structurally cannot: how issuance is distributed across a national market, which hosting bases carry which authority, which sectors still pay for validated certificates rather than taking free ones, and how much of a shift over the past year came out of one brand. Questions of that shape are counts over a population, and the download supplies the population with country, suffix and the rest of the detected stack on the same row.