This past Friday, WordPress.com announced free HTTPS for all sites on the WordPress.com platform. This includes *.wordpress.com URLs as well as custom domains such as mycoolsite.com.
On the backend, WordPress.com is using Let’s Encrypt to issue those certificates.
The Let’s Encrypt project gave us an efficient and automated way to provide SSL certificates for a large number of domains. We launched the first batch of certificates in January 2016 and immediately started working with Let’s Encrypt to make the process smoother for our massive and growing list of domains.
Source: HTTPS Everywhere: Encryption for All WordPress.com Sites — WordPress.com News
For more information about the benefits and performance of HTTPS on WordPress.com sites, visit this article.