I read an interesting article about something called autocsr for SSL certs. After reading I still could not figure out how it works. Doesn't generation of CSR happen on my box? The CA won't have access to my box. Is it really safe as it proclaims? thanks
AutoCSR breaks with the principle that the private key should be generated on the machine where it will be used, and never leave that machine. It generates the public/private key pair on a machine of the CA, transfers the private key to you via the Internet in encrypted form together with the certificate, and erases it on the machine where it was created.
On one hand, this does indeed reduce security. Instead of controlling the private key yourself you have to trust the CA's procedures and security measures to ensure that the key generation is done securely, there are really no traces of your secret key left anywhere on their systems, and the key isn't disclosed to or manipulated by a malicious third party in transit.
On the other hand, it can increase security. Generating a public/private key pair securely requires some expertise. There have been incidents of weak keys, as well as services not offering encryption at all because the challenge of setting it up was too big for them, which could have been avoided by using a service like AutoCSR.
In sum, if do you have the experience and equipment available to do it properly, creating the key pair on the target machine will definitely be more secure. If not, it's a trade-off between your organization's capabilities and your trust in the CA to do it right.