Anyone can create a certificate for free. The cost arises from getting someone to say, "Yeah, this certificate can be trusted."
You can create a certificate and "sign" it. Its just a matter to add to the "client" (e.g. a browser) the necessary info to allow the client to trust on your C.A. We use to use "internal certificates" on MF encription (telnet) to avoid $$$. Or on "intranets". Why use a "public" CA if only internal computers will access that resource?
Backing on topic, Encription is cost x benefit: you dont protect what worth nothing. So why encript all? Its a nonsense.