According to this EFF presentation [1] (slide 24) where they scanned the internet for SSL servers in 2010, it's actually an underestimate -- in fact around 99.9

According to this EFF presentation [1] (slide 24) where they scanned the internet for SSL servers in 2010, it's actually an underestimate -- in fact around 99.995% of servers use SHA1. The query shown only considers certs created in 2010, though; I'm grabbing the data set to verify now, but I suspect that 98% is not unreasonable. Edit: Here's the full data. ~99%: mysql> SELECT `Signature Algorithm`, count(*) FROM valid_certs GROUP BY `Signature Algorithm`; +--------------------------+----------+ | Signature Algorithm | count(*) | +--------------------------+----------+ | md2WithRSAEncryption | 4 | | md5WithRSAEncryption | 13942 | | sha1WithRSA | 3 | | sha1WithRSAEncryption | 1441335 | | sha256WithRSAEncryption | 106 | | sha512WithRSAEncryption | 1 | +--------------------------+----------+ [1] https://www.eff.org/files/ccc2010.pdf https://www.eff.org/files/ccc2010.pdf