The state of TLS on
Australian websites

What we did

Every result on this page comes from a live TLS handshake we performed ourselves on 18 August 2026. We took the Tranco top-1 million list published on 17 August 2026 (list ID K9L5W), filtered it to every domain ending in .au — 8,376 of them — and connected to each one on port 443 using the same engine that powers the checker on our homepage. Nothing here is modelled, sampled or estimated.

Of those 8,376 domains, 7,669 completed a TLS handshake and are the basis for every percentage below. 357 did not answer on port 443 at all, and 350 did not resolve to a public IP address. The full methodology, including what those two categories exclude, is at the bottom of the page.

Who issues Australia's certificates

Certificate authority share, counted by the issuing organisation named on each certificate. Related brands are folded together — DigiCert's various legal entities count as DigiCert, Sectigo absorbs the old Comodo names, and so on.

We counted 41 distinct certificate authorities in total.

TLS version support

We probed each server for all four TLS versions separately, because a server can accept several at once — supporting TLS 1.3 does not mean TLS 1.0 has been switched off, and the two facts are what actually matter.

Almost all of it is one default setting

That 22.3% is not 22.3% of Australian operators making the same mistake. We resolved every scanned domain and checked whether it answers from a Cloudflare edge address, and the population splits almost cleanly in two.

A Cloudflare-fronted Australian site is roughly ten times more likely to accept a deprecated protocol than one that is not, and 80.0% of every deprecated-TLS domain we found sits behind Cloudflare. The reason is mundane: Cloudflare's Minimum TLS Version setting ships as TLS 1.0, and the setting lives in the dashboard rather than on the server, so most site owners have never seen it. The certificate, the origin and the site itself can all be perfectly modern while the edge in front of them still answers a TLS 1.0 hello.

Two things follow. The headline number describes a vendor default far more than it describes Australian system administration — and for most of the sites counted in it, the fix is one dropdown in the Cloudflare dashboard (SSL/TLS → Edge Certificates → Minimum TLS Version), not a server migration. It also means any scan of this kind that does not separate the two is largely measuring Cloudflare's market share.

How long Australian certificates last

Certificate lifetime is the gap between the not-before and not-after dates on the certificate itself, not the time left before it expires. It is the clearest signal of whether renewal is automated: ACME-issued certificates cluster at 90 days and below, while manually purchased ones sit near the 398-day maximum the CA/Browser Forum allows.

The median Australian certificate lasts 89 days.

What is actually broken

These are faults a visitor would see — each one produces a browser warning, not just a lower grade.

Grades

The grade each domain would receive from the checker on our homepage, using the identical grading code. What the grades mean.

By type of Australian domain

The .au namespace is divided by registrant type, and those groups do not behave the same way. Government and education domains are administered centrally; commercial ones are not.

Namespaces with fewer than 25 scanned domains are omitted — the percentages would swing too far on single results to mean anything.

Read the deprecated-TLS column against the Cloudflare column beside it and most of the variation disappears. gov.au has the cleanest protocol posture in the table, and it is also the namespace least likely to sit behind Cloudflare. Names registered directly at .au — the shortest-lived part of the namespace, opened to registration in 2022 — are the most exposed, and are also the most heavily Cloudflare-fronted; scanning them by hand, a large share are recently registered names on shared infrastructure rather than established sites. That row describes a hosting pattern, not a quality difference between Australian registrant types, and we would caution against reading it as one.

Do the biggest sites do better?

Ranked by position in the Tranco list, the 100 most popular Australian domains compared with everything below them.

Methodology

Population

Every domain ending in .au in the Tranco list published 17 August 2026 (ID K9L5W, permanently retrievable at https://tranco-list.eu/list/K9L5W) — 8,376 domains. This is the whole .au subset of that list, not a sample of it. Tranco is a research-oriented ranking that averages several popularity lists over 30 days specifically to resist the day-to-day manipulation that affects single-source rankings.

Measurement

One TLS handshake per domain against port 443 with SNI set to the domain, certificate parsed with OpenSSL, followed by one additional handshake per TLS version to establish which versions the server accepts. We connect permissively so that broken certificates can still be read, then validate separately — the same two-pass approach the live tool uses, and the reason expired and untrusted certificates appear in these counts rather than as connection failures.

One correction we had to make first

Our first pass reported that not one of the 7,669 servers accepted TLS 1.0 or 1.1. That was our bug, not a finding. From OpenSSL 3.0 the default security level refuses to negotiate those versions in the client, so every probe failed identically whether or not the server actually offered the protocol. We caught it because a clean 0.0% across thousands of hosts is not a believable result, confirmed it against test endpoints that serve exactly one legacy version each, fixed the probe and re-scanned the entire list before publishing anything. The same bug was live in the checker on our homepage, which had therefore never been able to warn anyone about TLS 1.0 — that is fixed too.

Identifying Cloudflare

After scanning we resolved every domain again and checked each returned address against Cloudflare's published edge ranges. A domain counts as behind Cloudflare when any of its A records falls inside one. This detects the proxy, not the customer's origin, and it will miss a site served through Cloudflare on address space not in those lists — so treat the Cloudflare share as a floor rather than an exact figure.

Denominators

Unless a table says otherwise, every percentage is a share of the 7,669 domains that completed a handshake — not of the 8,376 in the list. The 357 domains with no TLS service on port 443 and the 350 that did not resolve publicly are excluded from all of them.

What this does not measure

We check the apex domain only, not www or any other subdomain, so a site that redirects to a differently-configured host is measured at the name we asked for. We do not evaluate cipher suites, key sizes, OCSP stapling, HSTS or certificate transparency. A large share of Australian sites sit behind Cloudflare, Akamai or Fastly, so in those cases these figures describe the CDN's TLS termination rather than the origin server — which is genuinely what a visitor connects to, but is not a statement about the customer's own infrastructure.

Point in time

A single scan on 18 August 2026. Certificates renew constantly, so the expiry-related figures in particular are a snapshot rather than a stable property of the population.

Reproducing it

The aggregated results are published as JSON under a CC BY 4.0 licence — use them anywhere, with attribution. The Tranco list ID above pins the exact input, and the scanning code is the same engine behind the homepage checker, so any domain in the set can be re-checked by hand.