SSL
When the free SSL appears
A certificate is requested after the domain points at the account. It is not instant, and it will not issue for a name that still resolves somewhere else.
The certificate is requested when the domain resolves to the account. Until DNS is right, the request fails and retrying every minute does not help. Give it 20 to 30 minutes after the name starts answering here.
A certificate covers the names on the account, not every possible subdomain you might invent later. Add the subdomain, then request again. Wildcard coverage is not part of the free issuance described here.
Renewal is automatic while the name still points here. If you move DNS away, the next renewal fails, which is correct. Mixed content warnings are a site problem: pages still calling images over http. The padlock cannot fix those links for you.