Yes you are correct, SSL must be purchased. Providers like godaddy sell the ssl aside the other products increasing the value, others sell the ssl included.

>>>>
Hi,

I have been reading many pages about installing SSL certificate. A customer requested that I enabled SSL on my web application they use. My understanding, from reading all these pages, is that SSL certificate has to be PURCHASED; it is not just there on the web server to be enabled. Am I correct?

TIA