Intelligence · State of TLS · 2026
TLS Certificates in the age of AI
Navigating Security Defaults and a €27M Premium Gap
ShareShift unpacks how 25 leading European providers handle transport security and expansion economics in the age of rampant AI-driven cyber attacks.
Target
Product & Commercial Leaders
Publication date
September 2026
Author
Chris Iversen
INTRO
Executive Summary
Across 30+ million European domains hosted by Top 25 providers, transport security has split into a stark bimodal market: only two operators actively monetize premium TLS at scale, while the rest leave certificates unbundled or passively delegated. IONOS captures a 16% wildcard attach rate; Aruba holds 13% with its own CA. Every other major European brand sits below 1%, leaving an estimated €27.2M in annual gross profit unclaimed on the table.
This commercial inertia collides with an unforgiving regulatory timeline, overlayed on rapid AI advancements. AI-driven attacks lower the cost of impersonation toward zero, while browser root programs are pushing towards severely reduced cert validity making manual renewals impossible even on advanced certificates.
How should hosting operators adapt their TLS strategy, to help customers navigate a zero-trust web where bots interact with millisecond latency?
Market Fundamentals
Key Empirical Metrics
Top operators (IONOS & Aruba) capturing 92% of wildcard issuance; others average <1%.
2 of 25
Mandatory lifespan by 2029 forcing automated CLM tooling
47 Days
Context & Urgency
Why TLS Matters Now
Basic Transport Layer Security (TLS) encryption is no longer an optional add-on; it is infrastructure hygiene. An unencrypted website invites transport-layer tampering, immediate browser warnings, and severe organic search penalties.
Let’s also not forget: while securing the transport pipe, TLS does not validate intent. As demonstrated in the August 2026 Hetzner/Virtualizor BGP hijack, when an adversary hijacked IP routing, automated ACME pipelines diligently verified the fraudulent route and issued valid public certificates to the attacker. Relying solely on basic automated DV creates a false sense of security if routing and domain integrity are unmonitored.
Strategic Insight
Across 56+ million domains audited in ShareShift's infrastructure health scoring, 41% of all domains carry critical TLS-related errors: missing, expired, or misconfigured certificates.
The industry acknowledges encryption as essential, yet fails to deliver it reliably across four out of ten web assets.
AI attacks are accelerating, and shrinking certificate lifespans mean the old assumptions about TLS no longer hold. Browser root programs within the CA/Browser Forum are systematically dismantling long-term validity: moving from 398 days down to 100 days by March 15, 2027, and reaching 47 days by 2029. Continuous automation is becoming mandatory table stakes; manual customer renewals are effectively obsolete.
The good news is, Certificate Lifecycle Management (CLM) then becomes a product category priced separately from the certificates themselves. And as consumer-facing browser trust signals stay relevant (Not Secure chip, mixed-content blocking), SMBs continue to opt into TLS products. Then, the power of defaults and customer stickiness lock in product attach for years.
Strategic Framework
What This Means for Web Hosts
ShareShift has mapped observed data against marketed product offerings across top 25 vendors.
The result: a 2x2 matrix that cuts across the baseline floor and the commercial ceiling. Each quadrant showcases brands currently pursuing a distinct TLS strategy, and makes a recommendation on next steps.
Any hosting operator can find their current starting point here, and choose their new roadmap. ShareShift provides a 360' view on on x-sell opportunities across 500+ web hosts. Request a demo to discover the revenue potential of TLS in your own customer base.
Automated Default
Hostinger, one.com, All-Inkl
Auto-provisions free DV (predominantly via Let's Encrypt) post signup. Eliminates setup friction and churn, but carries zero attach of premium high-margin TLS offerings.
Strategic Move: Introduce plan-tier TLS upgrades without disrupting baseline automation.
FULL-STACK
Aruba
Baseline floor fully covered via auto-provisioned certificates paired with an upsell wildcard motion. Here, marginal costs per cert approach zero since Aruba operates its own publicly-trusted CA, Actalis. Other hosts will have to share revenue with 3rd-party CAs.
Strategic Move: Defend margins with automated multi-cloud CLM tooling.
Passive Delegation
{most hosts}
Passive customer delegation leading to severe health errors and zero monetization. For non-technical SMBs, this creates an operational failure point; for the host - increased support load. No-one wins.
Strategic Move: Do it right; deploy automated baseline security alongside CLM for top-tier customers.
Hosting Bundle
IONOS, GoDaddy
Benchmark attach (16%) is achieved by bundling wildcard certs into the higher hosting tiers and using them as the upgrade trigger. While IONOS does carry standalone SSLs too, 99% of its wildcards look the same.
GoDaddy runs a variant of this strategy, bundling its own CA's commercial DV certificates into hosting, for free for the first year only. The commercial goal is retention, not upfront revenue.
Strategic Move: Auto-provision free baseline DV across remaining accounts to arrest silent churn.
Price of Inaction
The €27 Million Opportunity
To estimate the revenue potential of outlined monetization strategies, ShareShift establishes the Strict Premium SSL Penetration Rate (PSPR): Strict PSPR = (OV + EV + Wildcard certificates) / Eligible domains*
*Eligible domains are those with a web hosting account set up, excluding for-sale and Cloudflare-fronted domains.
The conservative estimate of unclaimed annual gross profit from reaching a 12% monetization threshold exceeds 27 million euros. That's our calculation of the cost of opportunity across 23 out of 25 top vendors. These are among the largest domain operators in Europe, shortlisted here as presenting the largest unclaimed potential.
Note that the calculation does not account for any cannibalization of revenues from already-issued paid commercial DV certificates. This distinction is especially relevant for GoDaddy, which already generates significant revenues from its security business line.
Same Group, Different Playbooks
As the graph shows, group-level rollups mislead. Inside United Internet, IONOS runs the leading European premium SSL motion (16.1% wildcard attach). At the same time, Strato, its own sister brand on the same Sectigo contract with the same auto-provisioning pipeline, sits at 0.53% premium cert attach rate, and misses out on €3.5M in annualized gross profits. Similar reflections apply to Fasthosts (UK), Home.pl (PL), and United Domains. The same pattern repeats inside other hosting groups, including Aruba and team.blue.
Technical Reality
The Shift from Wildcards to Multi-SAN Orchestration
While wildcards (*.domain.com) have proven to be an undisputed commercial packaging win for IONOS, standards bodies and security authorities (such as the NSA and CISA) increasingly discourage broad wildcard usage in zero-trust architectures due to shared private key exposure and cross-protocol attacks. We do not judge what works commercially; however, for operators building a forward-looking monetization motion, modern alternatives like automated short-lived multi-SAN orchestration provide the same frictionless user convenience without the security tradeoffs.
Vendor Selection
Who Signs the Certificates
Unsurprisingly, Let's Encrypt is the largest TLS supplier in Europe, with 65.5% market share.
Within the paid-certificate provider set, GoDaddy's internal CA leads the pack with 9.7% share, all of it deployed on its own user base. Sectigo remains the core wholesale engine across European shared hosting, while DigiCert occupies a focused footprint centered on higher-trust enterprise and OV tiers. Google is a strong participant too, likely due to its GCP workflows.
Virtually all vendors at the top, bar Actalis, are US-based. By contrast, European CAs with regulatory standing (D-Trust in Germany, SwissSign in Switzerland, Buypass in Norway) are absent from the Top-25 list at any meaningful scale.
- Let's Encrypt65.5%
- GoDaddy9.7%
- Sectigo8.9%
- Google Trust Services8.7%
- ZeroSSL2.7%
- DigiCert2.2%
- Actalis2.2%
Execution Playbooks
Turning TLS Debt into Expansion Revenue
For most European hosters, basic auto-renewal remains an unmonetized cost of doing business. Yet revenue growth is easy to unlock: partner with a reputable vendor, and productize transport security across four distinct lifecycle plays.
ShareShift customers can size the ROI potential of each playbook based on their own domain base, and download a ready lead list to target. Request a demo today.
Play 1
Active-Business Floor Sweep
Auto-provision basic DV across all active, unencrypted websites at zero marginal cost. Closing this gap improves customer experience and eliminates browser conversion warnings before attempting monetization.
Play 2
Multi-Subdomain Orchestration
Identify accounts running fragmented single-name certificates across multiple hosts (e.g. shop., api., portal.) and transition them to unified multi-SAN management, packaging it as an upgraded hosting feature.
Play 3
E-Commerce Trust Packaging
Target active WooCommerce, PrestaShop, or custom shop setups with verified organizational credentials (OV), bundling organizational identity with dedicated IP and performance tiers.
Play 4
100-Day CLM Uptime Guarantee
Ahead of the March 2027 validity contraction, pitch automated multi-cloud certificate management as an uptime assurance add-on for agencies and multi-domain owners.
Conclusion
Practical Security Over Hype
Basic TLS encryption is neither an exciting high-growth novelty nor a commoditized detail hosters can afford to ignore. It is a fundamental operational standard. Operators that leave certificate installation to non-technical customers are generating avoidable friction, search penalties, and churn. Operators that automate the baseline secure their base, and those that thoughtfully package premium capabilities into plan tiers capture high-margin gross profit.
As certificate lifespans contract toward 47 days, automation will become standard practice across all networks. The choice facing leadership is whether to treat that migration purely as an operational compliance cost, or use it to re-architect how security value is packaged for their customers.
Benchmark Your Infrastructure & Monetization Potential
Discover hidden certificate exposure and quantify uncaptured expansion revenue across your hosting base with ShareShift market intelligence.