And can I do it for free!
Yes and no.
If you want to do it in a commercially viable way you have to purchase a security certificate from a CA and that's about the only mandatory cost.
You can however set up a SSL protected site using your own generated SSL key which will enable you to send your key to a client and have the traffic encrypted. This is enough to keep passwords etc. information from going in public. This might be, however, a problem if you do web commerce and you have random clients - they won't necessarily trust your certificate and, then, your site.