Phoenix has HTTPS and WSS support builtin, see http://www.phoenixframework.org/docs/configuration-for-ssl
For PFS I believe you need to configure your server to use specific key exchange algorithms (i.e. it’s not a matter of the certificate). I don’t know how to do that with Phoenix. Personally I terminate TLS with Nginx and proxy it to Phoenix.
HTTPS and WSS are end-to-end encrypted, one end being the client’s browser and the other end being the server.
For free certificates, take a look at https://letsencrypt.org/
