Lab · measurement · 25 August 2026

The map of published trust

A trusted list is a state saying, in machine-readable form, whom it vouches for. The European Union publishes a list of those lists, and that document is well known. What is less known is the shape of the whole thing: who points at whom, which pointers answer a strict client, and whether anyone is obliged to check.

Open the interactive graph → — the full instrument, with every node clickable for what was measured about it.

What the numbers say

The European hub carries 43 pointers, and that is the figure usually quoted. It is not a count of countries. Eleven of them point at a human-readable PDF of a list that is already present in machine-processable form, and one points at the hub itself. The denominator that matters is 31.

Four things worth saying plainly

The European list is in good health, and one fault in it was repaired during our series. Ireland's list could not be retrieved by a strict client: the server sent the leaf certificate without the intermediate that links it to a trusted root. We notified the operator at 21:33 UTC on 24 August 2026. Our runs failed twenty-five times in a row, the last at 07:00 UTC on 25 August. The first clean run came at 09:26 UTC the same day: the intermediate was present and the list came down clean. The record dates the repair; it does not show what caused it. All thirty-one machine-processable European lists now answer. That is the argument for a series over a snapshot: the defect and its repair are both in the record, each with a time.

The official monitor never saw it. Throughout those twenty-five observations, the European Commission's own Digital Signature Services dashboard reported the same Irish list as synchronised — downloaded, parsed and validated. Both readings were correct: that client completes a chain by fetching the certificate the server omitted, and ours trusts only what the server sent. Nothing was broken in the monitor. The defect was simply invisible to the instrument watching for defects, which is the finding underneath all the others.

That health is a property of that list, not of the idea. The Americas publish a regional list in the same format under the same standard. One of its four national pointers cannot be chain-verified — the same class of fault as Ireland's, in a different hemisphere — and Chile appears in the graph only through Argentina's national list, not through the regional hub at all.

Signatures do not carry freshness. The regional list is served from four addresses across three states. All four answer, all four carry a signature block, and three are byte-for-byte identical at a sequence whose declared next update passed 110 days ago. The only field separating the current copy from the lapsed ones is the one no rule requires anybody to read.

A third bloc points into Europe, and Europe has never pointed back. Chile, Colombia, Mexico and Peru publish trust lists for the Pacific Alliance in the same ETSI format — as zip attachments on a ministry page, with no hub anything can follow. Each declares exactly one pointer, and it names an ec.europa.eu address as the list of lists for territory “AP”; it redirects to the European one. All four lists are more than six years past their own declared next update. Four states have been declaring Brussels as their regional hub since 2019, and nothing in Brussels knows it.

Some lists are structurally invisible. Switzerland, Ukraine, the United Kingdom's live list, Moldova and Serbia publish trusted lists that no hub points at. Ukraine's was reissued the day before this measurement — the freshest list anywhere in the graph, and one nothing references. Moldova's carries no trust-service-provider section at all; its single pointer goes back to Brussels. Montenegro is reachable only through Serbia.

Then we asked the whole world

Two vantage points are not the world, so we asked it. On 25 August a TLS certificate check ran from the RIPE Atlas measurement network against two endpoints — Slovakia's, and Ireland's repaired one as a control — from 178 probes in 177 countries, on all six inhabited continents. Ireland's endpoint presented a certificate for its own name to 166 of the 178 probes; the other 12 saw no certificate at all, and none saw another name (Atlas measurement 204372082). Slovakia's endpoint did the opposite: it presented a certificate for its own name to not a single probe, on any continent. Of the 178, 177 saw a certificate for another name, which we withhold, and 1 saw none (measurement 204372076). An earlier run the same day, 479 probes in 75 countries, split the same way: the Irish control's own name on 460 probes and no certificate on 19, another name from the Slovak endpoint on 477 and no certificate on 2 (measurements 204352623 and 204352622). That is no longer a question of where we stand to look.

Slovakia's operator was notified on 25 August 2026. On 30 September the same host presented a certificate for its own name over HTTPS, valid from 3 September 2026, and answered a strict client cleanly. The pointer the European hub declares for Slovakia is still the http:// one.

The measurement that is easiest to run is the one most likely to invent a defect. A bare TLS probe that omits the server name reports a content-delivery network's default certificate as though a national list were misconfigured; even with the name sent, cloud hosting can hand a default certificate to some vantages and the real one to others. Every figure here reconciles the measurement network's result against a fetch of each pointer's real address. After that reconciliation, on 25 August, exactly one endpoint failed from every country and every method; every other list validated when it was fetched the way software fetches it.

What states publish when they publish no list

Most of the world does not publish a trusted list at all. What it publishes instead is a root certificate: the anchor itself, offered for download, with no statement about whom else the state vouches for. Argentina, India, Japan, Kazakhstan, Mexico, Qatar, Russia, Taiwan and the United States each publish one, and the map draws them apart from the lists, joined to nothing — because a trusted list is a claim about others and a root is a claim about yourself, and counting the two together would produce a bigger number and a worse one. Their country labels are the only ones on the map we asserted ourselves: a certificate carries no scheme territory to read.

Two of those distribution points cannot be read by a strict client. One national root host serves the wrong intermediate certificate and another serves none at all — the same fault as Ireland's. On 25 August the measurement network received the same broken chain from each host at 29 of 30 probes, and the 30th received no certificate, so it is not a quirk of where we stand. Both operators were notified on 27 August 2026; on 8 October both hosts still failed a strict client.

One state sits between the two categories. South Korea publishes a genuine machine-readable national list, but as a sequence-numbered Microsoft-format certificate trust list and a JSON register rather than the European XML. Its cycle is twenty-eight days, the shortest anywhere in the map, so it is the list most likely to fall out of date — which is why its currency is read out of the certificate itself rather than assumed from a successful download. Its register of forty-two accredited authorities carries twelve test and development hierarchies in among the production ones, told apart by nothing but their names.

What this is not

This measures whether a published endpoint answers a strict client, and what each list says about its own currency. It is not signature validation, not supervision, not a legal determination, and not a vulnerability assessment. A failing pointer means an artefact could not be retrieved from one vantage point at one moment; where an endpoint refused us specifically, it is recorded as refusing us rather than as broken, because a single vantage cannot tell those apart. Where a named operator is involved we write to them before we publish, and a fix before publication is the outcome we prefer to report. We do not route around a refusal: a result obtained by evading a block would no longer be a measurement of what a client sees.

The instrument →  ·  Conformance and measurement in the Lab →