I get the basic idea of public/private key pairs, but what I don't know is what is the inner workings of what IIS does when generating an SSL key.
One thing that makes me think there is more under the hood than just a PKI exchange, is that there are tools like OpenSSL that dig into webservers and expose different encryption abilities. These abilities appear be be based on some combination of Platform, WebServer, and Certificate signer.
Another thing I haven't actually figured out is what is the content of the key that Verisign/Comodo/etc will send me once the cert is generated. What are the security implications of that email, or can I just delete it since the key that matters needs to be exported from the IIS server.
Lastly, is the only way to get an SSL cert for a website to use IIS's control panel to create the keypair