Every plan includes a free SSL certificate for your domain. Once your domain points to your site, open it under Websites in your account and press Request certificate under Security & HTTPS. It usually arrives within 30 minutes; the same section shows when it's issued.
Then switch on Always use HTTPS there, so visitors who type http:// are sent to the secure address. Going live switches it on for you once your domain answers over HTTPS.
If your site still shows a certificate warning, press Check connection on the same page: both the @ and www A records must point to your site's IP address, and no old AAAA record may point elsewhere. Fix what it shows, then wait a little longer. If it has been more than 24 hours, contact support.