[kmac_]

> StartSSL's default usage mode is to generate private keys on their website.

No. AFAIR they use HTML5 <keygen> tag to generate key pair.

[drdaeman]

That's for personal (client) certificates.

For server certificates, unless you supply the CSR by yourself by skipping a step (IIRC, you're softly encouraged to do so), they generate the key server-side and send it to you back. They even have a FAQ entries (##43,44, although their site is down ATM, so Google for a cached copy) about that.

[kmac_]

You're right, I've mixed up things.