Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not.
One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer makes is to check for ownership of the domain by the entity requesting it.
For "manual" issuers, this often involves uploading a file to a web server on this domain, creating a DNS record or clicking on a link in an email to the registrant, administrator or technical contact in the whois record of the domain.
You can replicate this process for your needs for your SaaS application by using LetsEncrypt: It allows you to either
- upload a file to a folder on a web server for the domain: In this case you would advise the client to point an A record (or probably better CNAME) to your server and once resolved, you can issue the certificate with letsencrypt by copying the file yourself
- create a specific DNS record, which again allows you to create the certificate.
Lets encrypt certificates are valid for 90 days, but as you will need the A record in place in anycase to run your SaaS, you will be able to renew the certificate yourself regularly.
P.S.: Not too long ago, subsidiaries of Symantec were found (twice) to not always have checked domain ownership and then did not appear to take remedial action consistently (twice). This led to the "distrusting" of all Symantec certificates in Chrome and Firefox after giving owners of these certs some time to create new certificates.