State of SSL/TLS in Runet 2026
Based on Enterno.io SSL scans in Q1 2026: TLS 1.3 is supported by 87% of Runet sites, TLS 1.2 by 99%. Grade A or higher — 62% of sites. Let's Encrypt dominates (58% of issued certs), GlobalSign and DigiCert split the rest of the commercial segment.
Methodology
Analysis based on SSL scans via Enterno.io SSL Checker during Jan-Mar 2026. Sample: ~50,000 unique domains in .ru, .рф, .su + RU-hosted sites on international TLDs. Each scan ran: full certificate chain, supported TLS versions, cipher suites, OCSP/CRL status, SSL-Labs-like grade.
TLS protocol adoption
| TLS | Support | YoY trend |
|---|---|---|
| TLS 1.3 | 87% | ↑ +12 pp |
| TLS 1.2 | 99% | ↔ |
| TLS 1.1 | 8% | ↓ −15 pp |
| TLS 1.0 | 4% | ↓ −11 pp |
| SSL 3.0 | < 1% | ↓ |
TLS 1.3 continues to rapidly replace 1.2 — Chrome 90+ dropped older versions, ISPs begin blocking TLS 1.1/1.0 at the firewall (PCI DSS compliance).
Grade distribution
| Grade | % of sites |
|---|---|
| A+ | 18% |
| A | 44% |
| B | 21% |
| C | 11% |
| D-F | 6% |
Typical causes of grade < A: missing HSTS (9% of sites don't emit the header), outdated ciphers (CBC mode), missing OCSP stapling.
Top CAs in Runet
- Let's Encrypt — 58% (free, automated)
- GlobalSign — 12%
- DigiCert — 8%
- Sectigo (formerly Comodo) — 7%
- GoGetSSL — 4%
- Cloudflare (auto-issued) — 6%
- Others — 5%
Let's Encrypt share keeps growing — certbot automation became standard. Russian CAs have negligible presence (< 1%).
Recommendations
- Enable TLS 1.3 — required for new deployments.
- Disable TLS 1.0/1.1 — deprecated in 2021.
- Set up HSTS (preload) — free grade upgrade.
- Monitor SSL expiry 14 days ahead via Enterno.io monitoring.
- Regularly check grade via SSL checker.
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
How-to
Frequently Asked Questions
Is the data current?
Data collected in Q1 2026. Updated quarterly.
Can I cite this?
Yes, with attribution to Enterno.io.