An SSL cert is required for CPI integration - the return page has to start with https:// - it fails for self signed and (so far for me anyway) all the free certificate authorities.
You don't need the merchant ID for the CPI or API, the things that are required you enter through the admin section in the HSBC payment module.