Intelligence · State of TLS · 2026
TLS Certificate Split
Navigating Security Defaults and a €27M Premium Gap
ShareShift unpacks how 25 leading European providers handle transport security and expansion economics, and compares the operational reality to analysts' predictions.
Target
Product & Commercial Leaders
Publication date
September 2026
Author
Chris Iversen
INTRO
Executive Summary
Market research firms model transport security as a steady low-drama growth category. Our own telemetry across 30M+ hosted European domains tells a more nuanced story: growth in certificate volume isn't growth in monetized attach. Only 2-3 operators actively monetize TLS at scale, while the rest leave certificates unbundled or passively delegated. Most hosting operators carry <1% attach rate of premium certificates, leaving est. €27M in annual gross profit unclaimed.
That inertia now collides with a hard deadline: browser root programs are cutting certificate validity to 100 days by March 2027 and 47 by 2029, making manual renewal obsolete regardless of whether operators ever decide to monetize. And the cited security risks are not theoretical: weeks before this report published, attackers hijacked a major European host's network and used the gap to issue themselves a valid certificate in its name.
How should hosting operators adapt their TLS strategy, to help customers navigate a zero-trust web where bots interact with millisecond latency?
Market Fundamentals
Key Empirical Metrics
Top operators (IONOS & Aruba) capturing 92% of wildcard issuance; others average <1%.
2 of 25
Mandatory lifespan by 2029 forcing automated CLM tooling
47 Days
Context & Urgency
Why TLS Matters Now
Basic Transport Layer Security (TLS) encryption is no longer an optional add-on; it is infrastructure hygiene. An unencrypted website invites transport-layer tampering, immediate browser warnings, and severe organic search penalties.
Let’s also not forget: while securing the transport pipe, TLS does not validate intent. In the Hetzner/Virtualizor BGP security incident in August, attackers hijacked the network and were issued a valid, trusted certificate in the host's name. They used it to push a fake software update to customers who had no way of knowing anything was wrong. The certificate worked exactly as it was supposed to. That's the point. Relying on basic automated DV creates a false sense of security if routing and domain integrity are unmonitored.
Strategic Insight
Across 56+ million domains audited in ShareShift's infrastructure health scoring, 41% of all domains carry critical TLS-related errors: missing, expired, or misconfigured certificates.
The industry acknowledges encryption as essential, yet fails to deliver it reliably across four out of ten web assets.
Shrinking certificate lifespans mean the old assumptions about TLS no longer hold. Browser root programs within the CA/Browser Forum are systematically dismantling long-term validity: moving from 398 days down to 100 days by March 15, 2027, and reaching 47 days by 2029. Continuous automation is becoming mandatory table stakes; manual customer renewals are effectively obsolete.
The good news is, Certificate Lifecycle Management (CLM) then becomes a product category priced separately from the certificates themselves. And as consumer-facing browser trust signals stay relevant (Not Secure chip, mixed-content blocking), SMBs continue to opt into TLS products. Then, the power of defaults and customer stickiness lock in product attach for years.
Strategic Framework
What This Means for Web Hosts
ShareShift has mapped observed data against marketed product offerings across top 25 vendors.
The result: a 2x2 matrix that cuts across the baseline floor and the commercial ceiling. Each quadrant showcases brands currently pursuing a distinct TLS strategy, and makes a recommendation on next steps.
Any hosting operator can find their current starting point here, and choose their new roadmap. ShareShift provides a 360' view on on x-sell opportunities across 500+ web hosts. Request a demo to discover the revenue potential of TLS in your own customer base.
Automated Default
Hostinger, one.com, All-Inkl
Auto-provisions free DV (predominantly via Let's Encrypt) post signup. Eliminates setup friction and churn, but carries zero attach of premium high-margin TLS offerings.
Strategic Move: Introduce plan-tier TLS upgrades without disrupting baseline automation.
FULL-STACK
Aruba
Baseline floor fully covered via auto-provisioned certificates paired with an upsell wildcard motion. Here, marginal costs per cert approach zero since Aruba operates its own publicly-trusted CA, Actalis. Other hosts will have to share revenue with 3rd-party CAs.
Strategic Move: Defend margins with automated multi-cloud CLM tooling.
Passive Delegation
{most hosts}
Passive customer delegation leading to severe health errors and zero monetization. For non-technical SMBs, this creates an operational failure point; for the host - increased support load. No-one wins.
Strategic Move: Do it right; deploy automated baseline security alongside CLM for top-tier customers.
Hosting Bundle
IONOS, GoDaddy
Benchmark attach (16%) is achieved by bundling wildcard certs into the higher hosting tiers and using them as the upgrade trigger. While IONOS does carry standalone SSLs too, 99% of its wildcards look the same.
GoDaddy runs a variant of this strategy, bundling its own CA's commercial DV certificates into hosting, for free for the first year only. The commercial goal is retention, not upfront revenue.
Strategic Move: Auto-provision free baseline DV across remaining accounts to arrest silent churn.
Price of Inaction
The €27 Million Opportunity
To estimate the revenue potential of outlined monetization strategies, ShareShift establishes the Strict Premium SSL Penetration Rate (PSPR): Strict PSPR = (OV + EV + Wildcard certificates) / Eligible domains*
*Eligible domains are those with a web hosting account set up, excluding for-sale and Cloudflare-fronted domains.
The conservative estimate of unclaimed annual gross profit from reaching a 12% monetization threshold exceeds 27 million euros. That's our calculation of the cost of opportunity across 23 out of 25 top vendors. These are among the largest domain operators in Europe, shortlisted here as presenting the largest unclaimed potential.
Note that the calculation does not account for any cannibalization of revenues from already-issued paid commercial DV certificates. This distinction is especially relevant for GoDaddy, which already generates significant revenues from its security business line.
Same Group, Different Playbooks
As the graph shows, group-level rollups mislead. Inside United Internet, IONOS runs the leading European premium SSL motion (16.1% wildcard attach). At the same time, Strato, its own sister brand on the same Sectigo contract with the same auto-provisioning pipeline, sits at 0.53% premium cert attach rate, and misses out on €3.5M in annualized gross profits. Similar reflections apply to Fasthosts (UK), Home.pl (PL), and United Domains. The same pattern repeats inside other hosting groups, including Aruba and team.blue.
Technical Reality
The Shift from Wildcards to Multi-SAN Orchestration
While wildcards (*.domain.com) have proven to be an undisputed commercial packaging win for IONOS, standards bodies and security authorities (such as the NSA and CISA) increasingly discourage broad wildcard usage in zero-trust architectures due to shared private key exposure and cross-protocol attacks. We do not judge what works commercially; however, for operators building a forward-looking monetization motion, modern alternatives like automated short-lived multi-SAN orchestration provide the same frictionless user convenience without the security tradeoffs.
Vendor Selection
Who Signs the Certificates
Let's Encrypt's 65.5% share is usually read as evidence the market has "solved" transport security. It's the opposite signal: two-thirds of European certificates sit on infrastructure that was never designed to be monetized, and the operators sitting on that free base aren't moving customers up into anything paid. The operators' revenue reality is diverging from the analyst growth story of 14% CAGR.
Within the paid-certificate provider set, GoDaddy's internal CA leads the pack with 9.7% share, all of it deployed on its own user base. Sectigo remains the core wholesale engine across European shared hosting, while DigiCert occupies a focused footprint centered on higher-trust enterprise and OV tiers. Google is a strong participant too, likely due to its GCP workflows.
Virtually all vendors at the top, bar Actalis, are US-based. By contrast, European CAs with regulatory standing (D-Trust in Germany, SwissSign in Switzerland, Buypass in Norway) are absent from the Top-25 list at any meaningful scale.
- Let's Encrypt65.5%
- GoDaddy9.7%
- Sectigo8.9%
- Google Trust Services8.7%
- ZeroSSL2.7%
- DigiCert2.2%
- Actalis2.2%
Execution Playbooks
Turning TLS Debt into Expansion Revenue
For most European hosters, basic auto-renewal remains an unmonetized cost of doing business. Yet revenue growth is easy to unlock: partner with a reputable vendor, and productize transport security across four distinct lifecycle plays.
ShareShift customers can size the ROI potential of each playbook based on their own domain base, and download a ready lead list to target. Request a demo today.
Play 1
Active-Business Floor Sweep
Auto-provision basic DV across all active, unencrypted websites at zero marginal cost. Closing this gap improves customer experience and eliminates browser conversion warnings before attempting monetization.
Play 2
Multi-Subdomain Orchestration
Identify accounts running fragmented single-name certificates across multiple hosts (e.g. shop., api., portal.) and transition them to unified multi-SAN management, packaging it as an upgraded hosting feature.
Play 3
E-Commerce Trust Packaging
Target active WooCommerce, PrestaShop, or custom shop setups with verified organizational credentials (OV), bundling organizational identity with dedicated IP and performance tiers. For these customers, trust and reputation mean business.
Play 4
100-Day CLM Uptime Guarantee
Ahead of the March 2027 validity contraction, pitch automated multi-cloud certificate management as an uptime assurance add-on for agencies and multi-domain owners. This Play is built to reduce risks like those materialized in the recent Hetzner incident.
Conclusion
Practical Security Over Hype
TLS encryption is neither a clear growth story that the analysts paint, nor a commoditized detail that web hosts can afford to ignore. It is a fundamental operational standard. Operators that leave certificate installation to non-technical customers are generating avoidable friction, search penalties, and churn. Operators that automate the baseline secure their base, and those that thoughtfully package premium capabilities into plan tiers capture high-margin gross profit.
As certificate lifespans contract toward 47 days, automation will become standard practice across all networks. And the security case earlier in this report is what "automation isn't enough" looks like when it actually happens.
The strategic choice facing leadership is whether to treat the TLS migration purely as an operational compliance cost, or use it to re-architect how security value is packaged for customers.
Benchmark Your Infrastructure & Monetization Potential
Discover hidden certificate exposure and quantify uncaptured expansion revenue across your hosting base with ShareShift market intelligence.