Setting up a wildcard certificate, question about generating CSR?

Question

I have registered a new domain for a project. The hosting is actually done by a vendor. I have set the nameservers according to the vendors specs. Now they are requiring the cert in PFX format. When I go to provision the cert in godaddy (I know) it asks for the CSR. I'm not familiar with this at all, but after some research my primary question is can I generate the CSR on any machine or does it actually have to be on the server that will host the domain? Secondary question would be what do I use to generate it? I looked into CertUtil.exe but most of the documentation is old and I don't see anything related to CSR. Looks like I can create it with certutil using these instructions.

Answer 1

What you are supposed to generate is the cryptographic key pair. You keep the private part; the certificate request (CSR) contains the public key. The CA (godaddy) wants your public key since that's what they will put in your certificate.

Theoretically, the best place where you can generate the key pair is on the server itself: the value of the private key is that it is private, and the more it travels, the more it risks to be exposed. However, it seems that you want to send the certificate "as a PFX file", which means the certificate and the private key, bundled together as an archive (which is password-protected). Thus, the private key will travel. Under these conditions, you may as well generate the key pair on a machine where it is most comfortable for you.

In the Microsoft/Windows world, the tool to generate certificate requests is certreq.exe. That tool works with a configuration file (that they call an "INF file", though there is no actual need that its name ends with ".inf"). The configuration file sets the fine details of key generation (key type, key length, name in the CSR,...). The CA, or the vendor who ask for a PFX file, should help you with that (I mean, I cannot guarantee that they will help you, but it is their job to do so).