unfortunately you cannot certify hotspot with ssl...
i tried too but ssl works with domain-ip assignment
so when a user requests google.com with ssl (https) it needs to be redirected to hotspot but to be redirected without warning for invalid ssl certificate has to verify that google.com belongs to 64.233.166.105 first and make the ssl verification aswell which is not possible for a hotspot.
it would be a security issue if you could type
https://www.google.com on your browser and hotspot page popped up without ssl certificate warning.
better stick to http or create a self signed certificate and instruct your customers to bypass ssl warnings. no need to pay for ssl its the same for hotspot.
google chrome browser i think if you request an https site through mikrotik hotspot (no ssl) pops up a second window to hotspot login.