How to obtain a certificate from CA for setting up a externally-accessible registry server?

I am trying to set up my own registry server by following the instructions from here.
But I need to

have already obtained a certificate from a certificate authority (CA).

I tried the following commands that I learned from here.
$ openssl genrsa -out client.key 4096
$ openssl req -new -x509 -text -key client.key -out client.cert

But it does not generate the certificate from CA.

Could you please tell me how can I obtain a certificate from a CA? Is there any free way that does not cost anything?