SSL Dragon

TLS didn’t get more complex, but infrastructure did. One service can now run on four different certificates at once, all enforcing trust at separate layers.

Browsers deprecated SHA-1 years ago. But deeper in the hierarchy, it kept lingering in older intermediates and revocation data. Invisible to users, but still embedded in trust infrastructure.

SHA-1 is finally gone from public certificate chains. At SSL Dragon, we track hierarchy changes closely, and the CA/Browser Forum’s latest ballot sunsets the remaining SHA-1 signatures across SubCAs and CRLs.

Moldova and Ukraine fall into that second group. Not big buyers. Big operators. Few clients, huge workloads.

That’s because buying SSL and running it are two different things. One is about customers. The other is about infrastructure.

SSL Dragon has customers worldwide, but a few unexpected countries buy a surprisingly large number of certificates.

Those countries aren’t big buyers. They’re big operators. Few clients. Huge certificate volumes. It means certificates are being run as infrastructure, not bought one by one.

And the top 10 isn’t just “the usual suspects.” Alongside the US and UK, you see countries like Kazakhstan and Seychelles ranking high in active services. That’s where it gets interesting.

Commercial SSL certificates don’t spread evenly at all. They pile up in a few places. One country alone accounts for 38% of all paid SSL purchases. The top 10 control over 67%.

The problem wasn’t one isolated system. Because the councils rely on shared infrastructure, the disruption spread quickly once attackers were inside. This is how localized breaches become public outages.

Several London councils were forced to shut down digital services after a cyberattack hit shared IT systems. Housing, council tax, and parking services were affected.