A small static site I operate recently got HTTPS with zero action on my part. My hosting provider just did it of their own initiative and notified me that it was now done. I suppose they're going to do whatever ongoing maintenance it requires.