A public and private key are generated
by a certificate authority.
You may opt to allow the certificate authority generate the private key for you, but you do not have to. You can generate the private key on your own system and then submit a certificate signing request to the certificate authority. The certificate authority does not ever need to know your private key. If you are really paranoid about security, you shouldn't let them generate the private key for you.
This information can be saved within a
"certificate" and then used by the
client to authenticate.
Why is it possible to have a
certificate without a private key?
For a service to authenticate that your key is valid they either need to trust the Root key for the certificate authority that has generated your certificate, or they need they a copy of you certificate with the public portion of the key. A service which authenticates you does not need your private key.
How is a cert without a private key
Some services may not want to trust every key that is issued by a CA. So they may want to save the public version of your key so they know you are you. Of course if they trust the CA to put valid information into the Subject, then
Can a private key be requested at any
time if a public key and CA is already
It should never be possible to retrieve the private key if you have only the public key.
If you allow your CA to generate your private key for you, and they save the private key on their system and have a weak security I guess the CA could be attacked and the private key retrieved. The public portion of the key will contain information about the CA. These seems pretty unlikely though.