For others who read this, it can take 24 hours for the SSL to start working after you add or change a domain on a Tommy or Ricky account. In addition, the account must allow plain HTTP connections to the .well-known folder which appears in the docroot for the domain (if you use .htaccess or similar to force HTTPS, an exception must be added for this folder or the redirect must be removed).