This is a question I have been asked lately a lot. While Google says: HTTPS (SSL) is a Ranking Signal, the practice has shown this claim to be incomplete.
In fact, many SEO Researchers say that HTTPS has no real impact at the moment.
Considering the lower prices of SSL Certificates, it does not hurt to have it implemented. It costs about 18$ to buy a cheap SSL certificate. You will need an additional dedicated IP (about 12-24$year depending on your data-center), but totally worth it, considering you will have a secure communcation to your webserver/mailserver.
Usually Google does not penalize at the first years of notifying new ranking signals. The ranking signal of SSL implementations might be more advantageous on future google-algorithm changes.