I have recently couple customers who has complain about how to configure the SSL certificate on a custom domain for a portal in power apps. The issue is the same:
They have buy domain from office 365 and when they try to configure the custom domain--> the domain seems to be unsecure. The reason is that when they buy the custom domain from Office 365 they are not aware that the SSL certificate should be purchase separately. Which bring to big confusion and misunderstanding of the customers. The documentation is not clear about it and it will save a lot of time and efforts for us the software support engineers and more important to the customer this small but really important details. Here is the official documentation:
https://docs.microsoft.com/en-us/microsoft-365/admin/get-help-with-domains/buy-a-domain-name?view=o365-worldwide

My suggestion for a new idea is in documentation to be included that the domain doesn't come with an SSL certificate and it must be purchase separately. Or to be included in the step where you buy the domain address.