Do I need to buy an ssl certificate for a subdomain?

Question

Digital certificates

If the front is on site.ru and the back is on api.site.ru
I want to put an ssl certificate on the front
Exchange through the rest api
, do I need to put on the back too?

Answer 1

Just change api to https. For any resource working on https and addressing somewhere on http, the browser will swear

Answer 2

If data transfer is exclusively within your infrastructure (between front and back over the local network) - optional. If requests are sent to the API from somewhere outside (including directly from the client's browser) - yes, it is necessary.
But you need to understand that no one is forcing you to buy , unless you are one of "these".