HTTPS and certificates on Turkish websites in 2026: how many are ready for Chrome’s warning and shorter certificate lifetimes?

Summary

• Share of sites Chrome 154 will open behind a warning (HTTPS not working, or a certificate the browser rejects) — large sites 1 per cent · exporters 2 per cent · random .com.tr 8 per cent.
• Share of sites whose http address still does not redirect to https — large sites 9 per cent · exporters 18 per cent · random .com.tr 22 per cent.
• Share of sites using a certificate longer than 100 days — certificates this long cannot be issued after March 15, 2027 — large sites 65 per cent · exporters 41 per cent · random .com.tr 13 per cent.
• Median certificate lifetime (days) — large sites 199 · exporters 90 · random .com.tr 90.
• Share of sites with an HSTS header — large sites 53 per cent · exporters 34 per cent · random .com.tr 23 per cent.

The three groups split into two different risks. Random .com.tr sites have the highest share of sites behind a warning and the lowest share of certificates longer than 100 days: the most common certificate there is Let’s Encrypt’s 90-day certificate. On the most-visited sites the picture is reversed: few sites behind a warning today, many certificates whose renewal routine will change on March 15, 2027.

Sample and method

We measured three lists. The first is the 500 most-visited .tr domains in Turkey: the first 500 names ending in .tr in the October 6, 2026 Tranco list (the list of the Machine Readability Index). The second is Turkey’s large exporters: 154 domains we selected by province and sector from TİM’s “Turkey’s Top 1000 Exporters 2025” list and confirmed as each company’s own site. The third is random .com.tr sites: we picked random blocks from the URL index of Common Crawl’s October 2026 crawl and drew 500 domains with a fixed seed from the .com.tr domains in those blocks that were not on the first two lists. Each site was measured once, on November 8, 2026.

We sent each site three requests, without opening a browser:

• One request to the site’s http address; we followed the redirects step by step to see whether the chain ended on https.
• We read the TLS certificate the site presents: does it chain to an authority browsers trust, does the name match the site, has it expired, how many days is it valid and who issued it.
• One request to the site’s https address; we looked for the HSTS header that tells the browser to open the site over HTTPS only.

The results are aggregated and anonymous; we do not name any site. Shares are based on reachable sites: domains that answered neither the http nor the https request were counted separately.

Results

We reached 479 large sites, 151 exporter sites and 492 random .com.tr sites; 21, 3 and 8 domains answered neither request and are not in the shares.

The http request. Of the sites that answered the http request, the chain ended on https for 402 of 441 large sites, 118 of 144 exporters and 368 of 470 random .com.tr sites. Most of the sites that stay on http also have working HTTPS — only 4, 3 and 31 sites have no working HTTPS either. Because Chrome opens these addresses over https on its own, visitors usually see no warning; but other browsers, old links and bots may stay on http.

Sites behind a warning. The number of sites where HTTPS cannot be set up at all, or whose certificate is invalid in a way that triggers a browser warning, is 6 among large sites, 3 among exporters and 40 among random .com.tr sites. The causes are expired certificates, certificates for another name, self-signed certificates and handshakes that never complete. Chrome 154 asks visitors before opening the http address of these sites; visitors who arrive at the https address see the “Your connection is not private” screen.

Missing intermediate certificate. One defect is counted separately: the server not sending the intermediate certificate. This was the case on 13 large sites, 5 exporter sites and 5 random .com.tr sites. Because Chrome and Firefox usually fill in a missing intermediate themselves, visitors may notice nothing; but clients that do not — many apps, command-line tools and some bots — cannot set up a secure connection to the site.

Certificate lifetime. The number of sites using a certificate longer than 100 days is 298 among large sites, 58 among exporters and 56 among random .com.tr sites; among them, certificates issued before March 15, 2026 and longer than 200 days number 100, 26 and 21. Certificates this long cannot be issued after March 15, 2027: these sites will either automate renewal or renew by hand at least four times a year.

Who issues the certificate. The number of sites using a certificate from Let’s Encrypt, which issues free 90-day certificates, is 59 among large sites, 54 among exporters and 277 among random .com.tr sites. The certificates of 11 large sites were issued by TÜBİTAK’s Public Certification Centre (Kamu SM); almost all of them are public-sector domains.

About to expire. On the day of the measurement, the number of sites whose certificate had fewer than 30 days left was 46 among large sites, 14 among exporters and 13 among random .com.tr sites. If automatic renewal works, this is routine; if not, it is the next “Your connection is not private” screen.

HSTS. The header that tells the browser to open the site over HTTPS only is present on 242 of the large sites, 49 of the exporters and 100 of the random .com.tr sites that answered the https request.

Limits of the measurement

• A single moment: a certificate may have been renewed or expired the next day; the shares are a snapshot of November 8, not a distribution.
• The measurement was made from one place; some sites may answer differently by country or request at the network layer. Sites that did not answer are not in the shares.
• Certificates were validated by Node.js’s TLS layer, not by a browser. Chrome and Firefox usually fill in a missing intermediate themselves, so we did not count a missing chain as a browser warning and report it separately — it is a real defect for bots, apps and command-line tools.
• Lifetime is calculated from the certificate’s issue and expiry dates; from outside we cannot see whether renewal is automatic or manual. A certificate “longer than 100 days” does not mean it is renewed by hand; it means one that long cannot be issued after March 15, 2027.
• The random .com.tr sample is limited to sites Common Crawl has crawled; sites it never crawled are not in the sample. We did not look at each site’s size or sector.

For your own site

On your own site, this measurement comes down to five questions; the detail is in the “Not secure” warning guide.

• Does your http address go to https in one step?
• How many days is your certificate valid, and when does it expire? If longer than 100 days, the renewal routine changes after March 15, 2027.
• Who renews it, is it automatic, and who is notified if it fails?
• Does your server also send the intermediate certificate?
• Is the HSTS header there?