This question already has an answer here:
I'm attempting to install a certificate on a web server. I understand there is nothing secretive about the CSR. Obviously, I wouldn't want to reveal the private key I used to generate the CSR.
How about the certificate I receive back from the CA? As far as I can tell that's the same certificate that I will provide to the end user, correct?
I guess I'm a little confused because I've received certificates with public/private keys that I've installed within Windows so I can do SSO, VPNs, etc...