With a lot of IaaS environments you don't have direct access to the box doing TLS termination. In our case since we heavily use AWS ELBs, generating certificates directly on the box isn't an option. Moreover when you need to deploy onto many servers you generally run into the same issues with moving keys around that Lemur attempts to make easier/safer.