I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory Certificate Services (AD CS) to issue certificates for internal applications and websites, and this is where the confusion lies. Prior to this, whether it was IIS or Apache/Tomcat, we would generate CSRs through OpenSSL using a private key and passphrase.
Now that I'm researching AD CS, it appears that, for IIS, the CSR is created on the IIS server, and then processed through the CA server, generating the .cer/.crt and private key. We can extract the private key and store it in the event something happens.
But what about the passphrase? Does IIS not require a private key to have one? Is there a way to generate a CSR/private key in IIS using a private key passphrase? Can we still use OpenSSL to generate a .csr and process it through AD CS?