Hi Vasilis,
The DNS record required to obtain an SSL certificate is separate from the DNS records required to route traffic through Imperva CWAF.
This means it is possible to, and definitely recommended to acquire the cert prior to routing traffic to the site.
Once a site is onboarded to Imperva CWAF - you can think of it as "staged". It is not "live" until you modify the DNS record to the appropriate CNAME. (and/or A record if one is provided)
When the site is "staged" you can update your DNS accordingly to acquire the SSL certificate.
Please let me know if you have any questions.
Thanks.
------------------------------
Jaired Anderson
Imperva
------------------------------