What's the point of a digital certificate for which no private key exists?

Question

I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following:

1. create a private key (e.g. using openssl)
2. create CSR using the previously created private key
3. use the CSR to request a digital certificate
4. download digital certificate
5. create digital identity (pfx file) using the digital certificate (4.) and the private key (1.).
6. Use that pfx file to sign pdf, word files, mail, or any other file

The institution that I work for provides the employees different types of digital certificates (from digicert), for multiple purposes, one of which is digital signatures, which is my intended use. On the digicert webpage on which I can generate my own Premium digicert certificate, I only have one field to fill in, which is optional, the CSR field. Some other fields are prefilled, like my name, and the validity (1 year). Not knowing exactly what I'm doing, I first clicked on generate without creating a CSR first. Out of that I got 3 files, the client certificate, and 2 other certificates. They were useless in creating a pfx that can be used to sign documents without a corresponding private key. After a bit of research I learned that I am supposed to follow the steps above, but now I wonder why is the CSR optional. In what circumstances a client certificate without a private key can be used?

The output that I get from digicert when requesting a premium digital certificate seems to be the same, regardless of whether I fill in a CSR or not (3 crt files, one of which is on my name, the other 2 being the 2 companies that trust the client certificate). The only difference is that without a private key, I cannot create a pfx using openssl.

I even tried to create a pfx using the same private key for both sets of premium certificates (created with CSR and without CSR). For the set created with CSR it all worked out ok, and for the set created without filling in a CSR, openssl complained that there is no digital certificate matching the private key.

If my understanding is correct, without a CSR there can't be a link to a private key. Without a public-private key pair, what can one do with a digital certificate?

Answer 1

If my understanding is correct, without a CSR there can't be a link to a private key

Your understanding is wrong.
The CSR contains the public key and is signed by the private key. The private key is kept private by the owner of the certificate (which is not the CA). It is not given to the CA inside the CSR. The CA also does not need the private key but only the public key since the public key is ending up in the final certificate.

Answer 2

The certificate provider is giving you the option to either:

A. Generate your own key pair and CSR, and send the CSR to them for signing; or

B. Allow them to generate the key pair and CSR for you, they sign it, and you download the bundle from them containing both the certificate and private key.

The choice is yours: if you trust them to have a copy of your private key, option B is a good convenience factor that can make your certificate management easier. If you don’t/can’t/shouldn’t trust them, then your only option is to generate your own keys and provide them with the CSR to sign.

No matter what, you must have the private key in your possession in order to sign documents.