In addition to ad revenue issue r1ch mentioned (a friend of mine told me HTTPS ads provided less than half the revenue HTTP ads provide), there are a few other

In addition to ad revenue issue r1ch mentioned (a friend of mine told me HTTPS ads provided less than half the revenue HTTP ads provide), there are a few other things I've encountered while working on HTTPS support: - More ad network misbehavior: the last time I checked, a lot of HTTPS ads on AdSense would take up 100% CPU and lag the browser, because it would try to request an HTTP resource and fail in an infinite loop - More failed connections: just two weeks ago, a Firefox update made HTTPS sites inaccessible on computers with certain HTTPS-scanning antiviruses installed: https://news.ycombinator.com/item?id=10854629 https://news.ycombinator.com/item?id=10854629 - Browser bugs: Chrome doesn't let you HTML5-drag-and-drop data-URIs from HTTPS: https://github.com/Zarel/Pokemon-Showdown-Client/commit/53a1.. https://github.com/Zarel/Pokemon-Showdown-Client/commit/53a1.... - Warnings when embedding HTTP images: Users often embed HTTP images in community sites like forums, chatrooms, etc, which cause warnings in Firefox and make Chrome remove its "secure" designators - Annoyance: I tried to get a Let's Encrypt certificate recently. My server runs Node, and it doesn't serve arbitrary files from a directory (it's a WebSocket server) so the webroot method wasn't possible, so I actually had to stop the server and reconfigure the firewall not to redirect ports 80 and 443 to get the certificate. `letsencrypt-auto` also gives very cryptic error messages: apparently "Correct zName not found for TLS SNI challenge. Found" means "please use `sudo -H`". And the standalone verification failed for an unknown reason, but at least I eventually got the Apache verification working. And I'm going to have to go through all this again in three months...