SSL Grade Leaderboard: Top 100 Websites
Scanned from 20,000 top global websites · Updated 2026-11-07
| # | Domain | Grade | Score | 30d trend | Δ | TLS | Issuer | HSTS | Expires |
|---|---|---|---|---|---|---|---|---|---|
| 5701 | nus.edu.sg | A+ | 100 | — | – | TLS1.3 | GlobalSign Atlas R46 DV TLS CA 2026 Q3 | 50 d | |
| 5702 | nutanix.com | A+ | 100 | — | – | TLS1.3 | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | 119 d | |
| 5703 | nuxt.com | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 41 d | |
| 5704 | nwf.org | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 66 d | |
| 5705 | nwitimes.com | A+ | 100 | — | – | TLS1.3 | Google Trust Services | 80 d | |
| 5706 | nwo.nl | A+ | 100 | — | – | TLS1.3 | GEANT TLS RSA 1 | 92 d | |
| 5707 | nxp.com | A+ | 100 | — | – | TLS1.3 | Amazon RSA 2048 M01 | 164 d | |
| 5708 | nyc.gov | A+ | 100 | — | – | TLS1.3 | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | 122 d | |
| 5709 | nylon.com | A+ | 100 | — | – | TLS1.3 | Amazon RSA 2048 M04 | 109 d | |
| 5710 | nymag.com | A+ | 100 | — | – | TLS1.3 | GlobalSign Atlas R3 DV TLS CA 2026 Q2 | 66 d | |
| 5711 | nyp.org | A+ | 100 | — | – | TLS1.3 | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | 102 d | |
| 5712 | nytco.com | A+ | 100 | — | – | TLS1.3 | Thawte TLS RSA CA G1 | 133 d | |
| 5713 | nytimes.com | A+ | 100 | – | TLS1.3 | Thawte TLS RSA CA G1 | 133 d | ||
| 5714 | o2.co.uk | A+ | 100 | — | – | TLS1.3 | Thawte EV RSA CA G2 | 152 d | |
| 5715 | oakley.com | A+ | 100 | — | – | TLS1.3 | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | 63 d | |
| 5716 | obama.org | A+ | 100 | — | – | TLS1.3 | GeoTrust TLS RSA CA G1 | 125 d | |
| 5717 | obdev.at | A+ | 100 | — | – | TLS1.3 | GeoTrust TLS RSA CA G1 | 167 d | |
| 5718 | obi.de | A+ | 100 | — | – | TLS1.3 | Amazon RSA 2048 M01 | 165 d | |
| 5719 | observer.co.uk | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 84 d | |
| 5720 | oceanengine.com | A+ | 100 | — | – | TLS1.3 | RapidSSL TLS RSA CA G1 | 73 d | |
| 5721 | oeamtc.at | A+ | 100 | — | – | TLS1.3 | Thawte TLS RSA CA G1 | 155 d | |
| 5722 | oed.com | A+ | 100 | — | – | TLS1.3 | Amazon RSA 2048 M01 | 149 d | |
| 5723 | oeko-tex.com | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 37 d | |
| 5724 | oetiker.ch | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 43 d | |
| 5725 | ofgem.gov.uk | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 85 d | |
| 5726 | ohio.edu | A+ | 100 | — | – | TLS1.3 | InCommon RSA Server CA 2 | 107 d | |
| 5727 | ojp.gov | A+ | 100 | — | – | TLS1.3 | Google Trust Services | 50 d | |
| 5728 | ok.ru | A+ | 100 | — | – | TLS1.3 | HARICA DV TLS RSA | 181 d | |
| 5729 | oklahoma.gov | A+ | 100 | — | – | TLS1.3 | Sectigo Public Server Authentication CA OV R36 | 33 d | |
| 5730 | oklahoman.com | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 78 d | |
| 5731 | okmagazine.com | A+ | 100 | — | – | TLS1.3 | Google Trust Services | 80 d | |
| 5732 | okta.com | A+ | 100 | — | – | TLS1.3 | Amazon RSA 2048 M04 | 164 d | |
| 5733 | oktoberfest.de | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 52 d | |
| 5734 | okx.com | A+ | 100 | — | – | TLS1.3 | GeoTrust TLS RSA CA G1 | 173 d | |
| 5735 | oliverwyman.com | A+ | 100 | — | – | TLS1.3 | Sectigo Public Server Authentication CA OV R36 | 85 d | |
| 5736 | olx.pl | A+ | 100 | — | – | TLS1.3 | Amazon RSA 2048 M04 | 115 d | |
| 5737 | olx.ua | A+ | 100 | — | – | TLS1.3 | Amazon RSA 2048 M01 | 116 d | |
| 5738 | omgubuntu.co.uk | A+ | 100 | — | – | TLS1.3 | Google Trust Services | 63 d | |
| 5739 | omr.com | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 81 d | |
| 5740 | onb.ac.at | A+ | 100 | — | – | TLS1.3 | GEANT TLS RSA 1 | 122 d | |
| 5741 | one.com | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 46 d | |
| 5742 | onefootball.com | A+ | 100 | — | – | TLS1.3 | GeoTrust TLS RSA CA G1 | 114 d | |
| 5743 | onegreenplanet.org | A+ | 100 | — | – | TLS1.3 | Google Trust Services | 68 d | |
| 5744 | onepeloton.com | A+ | 100 | — | – | TLS1.3 | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | 90 d | |
| 5745 | onetonline.org | A+ | 100 | — | – | TLS1.3 | Sectigo Public Server Authentication CA DV R36 | 53 d | |
| 5746 | online-exams.org | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 43 d | |
| 5747 | onlineathens.com | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 78 d | |
| 5748 | onliner.by | A+ | 100 | — | – | TLS1.3 | GlobalSign GCC R6 AlphaSSL CA 2025 | 107 d | |
| 5749 | ons.gov.uk | A+ | 100 | — | – | TLS1.3 | Let's Encrypt | 64 d | |
| 5750 | onsemi.com | A+ | 100 | — | – | TLS1.3 | GlobalSign RSA OV SSL CA 2018 | 57 d |
Track grade changes for your domains
Sign up free, watch your domains and get alerted the moment a grade drops.
FAQ
How often is the SSL leaderboard updated?
Watched domains are scanned daily; the top-20K leaderboard refreshes full snapshots every Sunday.
How is the SSL grade calculated?
Protocol versions, cipher strength, certificate validity, HSTS and OCSP stapling are weighted into a 0-100 score, mapped to grades from A+ to F.
What does an A+ SSL rating mean?
A near-perfect TLS setup: TLS 1.3 enabled, strong cipher suites, full forward secrecy (PFS) and correctly deployed HSTS.
Methodology
CertH grades each domain via pure TLS handshakes (no server access required): certificate validity, key strength, protocol versions, HSTS and OCSP stapling are scored with a deduction model (100 minus itemized penalties) into a 0-100 score mapped to six grades from A+ to F. Daily snapshots accumulate into an auditable health trend.
What is an SSL grade?
An SSL grade (A+ through F) evaluates a website's overall TLS configuration: protocol versions, cipher strength, certificate validity and trust chain, HSTS and OCSP stapling. A higher grade means stronger resistance to man-in-the-middle attacks and data breaches.
Why track certificate health over time?
Expired certificates, CA switches and configuration regressions can silently drag a grade down. CertH daily snapshots record those changes so you can spot risk before failures, with auditable history as evidence.