Comment by erickt
11 years ago
That wouldn't be safe, because then they would have access to your private key and impersonate you. Having you (indirectly via their script) generate the key and submit the public key for signing means your private key never leaves the premises.
There is no reason for the CA to ever see the private key. All they need is a CSR. This approach is fundamentally broken.