Each plan lists a free certificate once the hostname points at the account. The target is the same day after that pointer is in place, with renewal from the panel. The pages do not name a certificate company, because the operator has not appointed one in this text.
If the name still points elsewhere, the panel cannot complete the challenge that proves control. Wait for delegation. That wait is the 48-hour registry window, not a failed delivery of the hosting account itself.
A certificate covers the hostnames on the order. Add a name you forgot as a separate step in the panel after the first one is issued. Mixed content, where a page still calls images over plain HTTP, is fixed in the site, not by ordering a second plan.
Paste a PEM into the SSL decoder if you want a local look at a block you already hold. The decoder does not contact the host and does not say the certificate is trusted.