Why The Web Has Not Switched To SSL-only Yet?

## Executive summary — This report explains the practical and operational barriers to moving all website traffic to HTTPS by default, including server CPU and hardware costs, added latency from repeated SSL handshakes (especially across many domains per page), CDN-hostname and certificate mismatches, limitations of wildcard certificates, mixed HTTP/HTTPS content problems with third-party services (ads, analytics), and the user-facing impact of certificate warnings; it notes these challenges are solvable but require careful planning and partner coordination.