Ah.. of course.. subdomain "cp" is aliased on the HSphere server.. that's where I was getting confused.
Ok, I've got a 1 month demo FreeSSL cert and added to my CP and everything went smoothly. However when I click the icon to "change reseller CP to Secure", it says the CP won't be accessible until you restart the CP.
After I click the link, when will the CP be reset? That is, when should I time it to minimise downtime of my CP?