We purchase the SSL Certificate through a 3rd party that covers across all our websites, including our own.
We purchase them because there is a big difference between Paid for and Free SSL Certs.
Many free ones have a limited lifespan, very little protection, no options (for securing subdomains or multiple domains), no warranty in case something goes wrong on CA's end, and have no trust or identity verification. This allows Google and other search engines to showcase that it is secure and not deter your customers from going to your site.

By default, there isn't a page on your website that isn't protected by our SSL Cert. That being said, if there is an image or widget that is embedded that comes from an unsecure source, that does cause our SSL to flag that something is wrong. For instance, if you have a weather widget embedded and the src="http://..." then that is showing a possible opening as the source it is pulling from is unsecure.

We run checks on your homepage to make sure that everything there is secure, and by default when we install the widget, we make sure it's secure. However, this only went into effect in late 2018 because Google and other search engines made a big push for websites to be secure. If there is an older unsecure widget on a hidden subpage before that time, we didn't have a way to check for it at the time.

However, there are scanners out there now that provide this service. One of which is: https://www.jitbit.com/sslcheck/