May have been suggested before -
A lot of network management apps and OS distroes have SSL generation (typically Open SSL or similar) built in, although RouterOS can use SSL/SSH in various settings. You cant generate your own SSL (although winbox appears to use a type of SSH).

It would be handy, especially on hotspot if the facility was inbuilt to generate the key pairs etc internally automatically, or at least on request if you fill in the required details.

Many of the docs just say to use open SSL on a linux box to generate your pairs, why not skip the middle man and have routerOS do it itself? As I understand it - theres a linux buried deep under there anyway, shouldn't be hard to build a SSL generator module?

You can generate a certificate request. You just cant sign it.