Expected increase of HTTPS in 2018 realized

22 January 2019

Many developments have happened in the international SSL market as well as at Xolphin. 2018 was a turning point for the use of SSL: for the first time ever, there are more secure websites than insecure websites. Early last year, a large increase of HTTPS use was expected, leading to secure connections being the new standard. One year later, this appears to be a realistic estimation: by now the top 100 websites worldwide use HTTPS. Between 70% and 80% of all pages are loaded over HTTPS, and by June 2018, 32.6 million SSL certificates were in use globally. This is an increase of 68% compared to 2017, and 500% compared to 2016! Let's take a look at other interesting developments in 2018.

Impact of the new privacy law

The introduction of the GDPR in May had a lot of impact on European SSL use. The new European privacy law has been in effect from May 25, 2018. This new privacy law made SSL obligatory for all European websites that collect data. Almost every website has an input field like a login field or a contact form. Handling customer data without encryption and without an SSL certificate now has serious consequences.

Changes in the display of HTTPS in Chrome

Google gave the use of SSL a boost by increasing visibility of warnings for websites without HTTPS. From July 2018, Chrome warns for insecure connections. In early 2017, Chrome started showing a 'secure' notice for websites with HTTPS. Google stopped displaying this 'secure' notice in September 2018, and replaced it with a warning for insecure websites instead: now a ‘Not Secure’ warning is shown for all insecure websites. This warning will become more visible over time. Nowadays, most browsers display warnings for insecure websites and insecure input fields.

SSL certificate use per type

Low-cost DV (domain validation) certificates are used most: about 94% of all issued certificates are DV certificates. Certificates with company data are often used by (larger) websites with more visitors. The use of DV, OV (organisation validation) and EV (extended validation) certificates is 38%, 49% and 13% respectively. This difference is even more significant for e-commerce websites, whose use of certificates with company data is 66% (of which 50% uses OV certificates, and 50% use EV certificates). Besides this, the validity period of all SSL certificates is limited to 2 years form March 2018, and TLS version 1.3 was released in August 2018.

The use of SSL for phishing websites has increased rapidly the last year. DV certificates without company data have the least strict issuance process, and are either free or very low-cost. Therefore, they are often used for phishing purposes. Research shows that more than half of all phishing websites use HTTPS. The HTTPS connection gives phishing websites a misleading, trustworthy appearance. The issuance process and validation for EV certificates is much more strict. This strict validation process minimizes the chance of abuse by phishing websites. To empower the importance of certificates with company data, multiple CAs established the London Protocol in June 2018.

In the Netherlands, the use of EV certificates has more than doubled over the last three years. Sectigo (formerly Comodo) has the biggest share in this with almost 70%. Whereas the main users used to be financial - and ecommerce websites, we now see an increase in use by SME’s.

Transition from Symantec to DigiCert

All Symantec, GeoTrust and Thawte certificates issued from the old Symantec infrastructure - before December 1, 2017 - are not trusted anymore since late 2018. The exact date differs per browser. After this date, certificates will trigger an error when visiting a website with an old Symantec certificate. Currently, the Certificate Authority DigiCert takes care of issuance of Symantec certificates. Do you still have valid certificates issued before December 1, 2017? You can reissue them free of charge.

Comodo continues as Sectigo

From November 1, 2018, Comodo CA is called Sectigo. This applies to the company name and all brand and product names. To ensure a smooth transition, the name ‘Sectigo, formerly Comodo CA’ will be used in 2019. Despite the new name, not much else will change. All certificates will continue to work. No adjustments or new installations are needed, and all certificates will still be trusted by browsers and applications. New trust logos based on the new logo are available, and from January 14 a new intermediate certificate will be used.