Yes, you need a SSL certificate to use WAF service. However, if you don't have a SSL certificate, we can issue a certificate for free.