Not to mention that some providers offer APIs to provide certificates without opening port(s) 80/443. This allows using nice domain names with valid SSL over the internal network too. Want to migrate a server or service? Just change the IP associated with the domain on the internal DNS. Makes migrating and upgrading a lot easier.