If your browser says “Not Secure”, that doesn’t mean that there is something wrong with your SSL setup, it simply means that no SSL is being used at all. If you click the link in your own post, as opposed to typing it yourself, you’ll see that it has valid SSL.
All free subdomains support HTTPS by default, but whether you actually want to use it is up to you.
If you do want everyone to use HTTPS, then you need to enforce that yourself: