its called a *private* key for a reason
don't let the certificate authority generate it for you and/or give it to the certificate authority
the only thing you are supposed to give to the certificate authority is the certificate signature request (CSR) and they give you the certificate after the validation process
#infosec