The other day I was was studying up on my Excel so I could help someone with a project, today I met with a friend where we were discussing the composition of root programs.

Since when you’re a plumber you fix everything with a wrench out came Excel and since sometimes I can’t let a problem sit still I spent far to much time slicing and dicing the Microsoft Root Program membership list.

There is a ton more that can be done, for example:

1. Root CA adoption relative to UN membership.
2. Root CA certificates based on validity dates.
3. Comparing the Microsoft Root Program membership to the Mozilla Root Program membership.
4. CAs per network (using AIA:OCSP urls as an indicator)
5. CA adoption of CDNs for OCSP and CRLs.
6. A look at how many operational facilities are associated with each organization (for example Symantec has 66 root CAs for there various brands are they all in the same facilities?).

Anyways it was a fun exercise and I thought I would share the results with you, here is the XLSX.

For those who do not want to look at the XSLX here are some statistics you may think are interesting:

1. 31.30% of the CAs were owned explicitly by governments.
2. 64.35% of the CAs were owned by commercial entities in the business of being third-party trust providers.
3. Of the 352 certificates they are owned by 115 organizations, 36 government, 74 commercial and 5 enterprise.
4. The USA has the most organizations who own CAs coming in at 13.04%.
5. Spain is next with 12.17% of the organizations owning  CAs being based there..
6. France is number three with 5.22% of the organizations owning  CAs being based there..
7. 17.33% of the roots use 1024bit keys.
8. 60.23% of the roots use 2048bit keys.
9. 18.47% of the roots use 4096bit keys.
10. 1.70% of the roots use ECDSA384 keys.
11. 115 of the 206 sovereign nations have CAs within their borders.