If you're trying to install a SSL for cPanel/WHM itself, the process is bit different. You would issue the csr for the hostname as normal. Have the SSL issued to the hostname as you have done but instead of installing through the SSL section of WHM you would go to Manage Service SSL Certificates under Service Configuration in WHM. You can then install the same SSL issued to the hostname for cPanel/WHM/Webmail Service, Exim and FTP service. The hostname is not an actual account in WHM so you wouldn't be able to move it to a dedicated IP. It's not a necessary step when installing a SSL for the hostname for use with WHM/cPanel etc.
After this is done, if you still want your client to be able to go to theirdomain.com/cpanel you should do the following:
Go to Tweak Settings
Click on the Redirection Tab
Select On for Always redirect to SSL
Select Hostname for Non-SSL redirect destination and SSL redirect destination
If you were to be installing a SSL for a domain (an account on the server) then yes, it would need to be under it's own IP.