an excellent company I used to use for hosting (who were later swallowed by by a not so excellent company) had a great solution to this. You'd log into your account and from there you could generate a single use token that you'd read to the csr.