There's a certain amount of back-and-forth involved in getting a domain-validated certificate. I say to the registrar "I want a cert for www.google.com" and they say back "Prove you control www.google.com by putting this file at www.google.com/yes-give-the-cert-to-michaelt.txt" then the registrar retrieves that file.

You also have to generate the private key in the first place, get the URL in the right field in the CSR, send the right file to the registrar (don't accidentally send them the private key!), convert between the dozens of file formats (.pem .crt .cer .key .der .p7b .p7c .pfx .p12 .jks), add the right intermediate certificates, put the file in the right place, make sensible cipher selections, set your file permissions right, make a secure backup of your key, check it works in several browsers and OSes - and repeat the whole process in a year or two when that certificate expires.

In the all-encrypted http2 world of the future, it would be better if the web server just took care of all that the first time it was started - just like a Linux server automatically generates a SSH private key at first boot.