Setting up SSL is painful if it ain't your daily business. The problem is, that it could give users a false sense of security if their mom-and-pop webshop uses cloudflare ssl or if it uses unsecured cookies or an outdated protocol etc, etc...

Regarding setting up SSL I'm reminded of this: https://news.ycombinator.com/item?id=8471877