Certificates don't have to be difficult. The major CDN and hosting providers can setup TLS automatically with no user action. CloudFlare rolled great command li

Certificates don't have to be difficult. The major CDN and hosting providers can setup TLS automatically with no user action. CloudFlare rolled great command line tools to handle internal certificates and CA (see cfssl). I've worked at startups with fully functional PKI. It's almost trivial to achieve, as long as you've got configuration management over all the servers (ansible, salt and assimilated). On the other hand. I've worked at a large bank trying to make TLS work across the firm and it was a mess. There was no motivation to have any automation around certificates management and no control over server configurations. One simple issue for example, CA on linux are managed by the ca-certificates package, all it takes to keep TLS working is to upgrade that package every couple years "apt-get upgrade ca-certificates". Some servers haven't had upgrade since 2015. It wasn't particularly difficult to get 10k servers from 5 departments upgraded after handing them instructions to do so, but of course a few other departments won't act until things break (and sometimes still won't act in spite of active incidents).