No you don't have to purchase a certificate. You can use LetsEncrypt which is a widely used open source solution that works great and is free.

If you're doing this on a Windows server you can use Win Acme which is a simple command line tool you can run on your server and get an SSL (TLS) certificate up and running literally in a couple of minutes.

Here's an older post of mine on Lets Encrypt and an older version of the WinAcme software that talks about what LetsEncrypt is and what the Windows software does in regards to IIS installation and how certificates are auto-installed and auto-updated.

FWIW, I use Lets Encrypt on all of my Web sites...

+++ Rick ---

>Hi,
>
>I have been reading many pages about installing SSL certificate. A customer requested that I enabled SSL on my web application they use. My understanding, from reading all these pages, is that SSL certificate has to be PURCHASED; it is not just there on the web server to be enabled. Am I correct?
>
>TIA