If you find yourself needing to use SSL in a hurry - you can get started with a self signed cert with the CloudBees SSL service
Assuming you have access to openssl:
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
will create a self signed cert you can use immediately with CloudBees (create a new router and away you go).
For any public web site or api, you will want to have a signed cert - so you can always do that at any time, and run:
bees app:router:update acme - ssl - cert SSL_CERT_FILE - pk SSL_PRIVATE_KEY
to update it to your real certificate, at any time.