EnterraHost
Free SSL is not something you have to ask for here. A certificate is issued to every website on this platform automatically, before you go looking for the setting. If your site already answers on https://, there is nothing to switch on. The work left is making sure the site uses it everywhere and that links pointing at http:// still land somewhere.
If it does not answer on HTTPS yet, or the status does not read Active, the certificate may have failed to issue. That is usually a DNS problem rather than a certificate problem, and pointing the domain at the right server is the fix.
Where free SSL is shown in the panel
Open Security in the top bar, then SSL certificates.
Each row shows a status, the domain, the certificate authority, whether force HTTPS is on, and the expiry date. A row reading Active opposite Let's Encrypt is the normal state, and the expiry reflects the certificate that is live at that moment rather than the one that will replace it.
Renewal happens on its own and is not a task for you. A new certificate is requested and installed before the old one expires, so the date in that column moving forward is expected and not a sign that anything needs doing.
Two rows can appear if you have both the apex domain and www on the site, and both need to read Active before Force HTTPS is worth switching on.
The three dot menu on the row does more than it looks like it does. Certificate details shows what is actually installed, which is the answer to give someone who doubts the site is encrypted. Request Let's Encrypt certificate for mail is a separate certificate for the mail server and has nothing to do with the website, so leave it alone unless you are setting up mail on this domain.
Turning on Force HTTPS, and what it breaks
The toggle in the Force HTTPS column makes the site redirect HTTP requests to HTTPS.
Turn it on once the certificate shows Active. At that point it is safe to switch on, and nothing further is needed from you. Doing it before the certificate is Active is the one order that reliably takes a site down, because the redirect sends visitors to a version of the site that has no certificate to serve.
Renewal is automatic as well. Certificates are renewed before they expire, so a date in that column moving forward is the normal state and never something you have to act on.
Two things follow from switching it on, and both catch people.
Every http:// link to your site becomes a redirect. That is the point, and it is fine for visitors. It is not free for anything that follows links and does not follow redirects, such as a feed reader or a script calling an endpoint. If something breaks within a minute of you flipping the toggle, that is the likely reason.
A redirect that runs on the server cannot reach a subdomain served somewhere else. If you have a cdn.yourdomain.com pointing at another provider without its own certificate, Force HTTPS on the website does not affect it, so nothing breaks there. What breaks is the reverse case, where a service expects a plain HTTP origin.
Installing a certificate you already own
If you have a certificate from somewhere else, or need a wildcard the automatic issuer will not give you, choose Install custom SSL.
The form asks for the domain, then the certificate in the Certificate (CRT) box and the matching Private key. Both can be pasted as text or uploaded as files.
The private key is the sensitive half. It is the thing that proves the site is the site, so paste it into the form rather than into an email, a ticket or a chat thread, and keep a copy somewhere that is not the web server.
A certificate sticks to the names written inside it. Installing a certificate issued for yourdomain.com on a site that also serves www.yourdomain.com leaves one of the two names without coverage. Check which names the certificate lists before you upload it, and add the second name as its own entry if the certificate does not include it.
If the certificate never issues
A row that will not go Active is almost always DNS. The issuer has to reach the domain from outside, and it cannot if the domain does not point at this server yet, or points at the old host, or sits behind a proxy that answers the challenge itself. Until the domain resolves here, no amount of clicking will issue a certificate.
Checking it worked on a page you have not opened in months
Load the site. The browser lock is the obvious signal and the least reliable one, because it gives no warning about mixed content until the offending element fails to load, and by then the visitor sees a broken layout rather than an error you can read.
The Server Check tool reports the certificate plainly, including the TLS version, the issuer and how many days are left. Put the domain in, and read the Security section. That tells you what the server presents rather than what your browser accepted.
Then try an old page. Mixed content failures show up there first, because a template that hard-codes an http:// image address keeps working until the page is served under a strict policy that refuses to load it.
The article on restoring a backup is worth reading before you change anything structural on a live site. A certificate is easy to reissue. A page builder's content is not.