You can generate the RSA keys anywhere. This produces a private/public key pair. Always keep track of where this private key is -- you may wish to (read: SHOULD) password protect/encrypt it. OpenSSL provides this functionality.
I like to think of it always in terms of a paired private/public key. The signing process just adds more information to the public key. Once you generate the CSR, you can lock away your private key for now. The CSR is your public key, plus information you wish to have signed by a CA, such as your name, country, perhaps a domain name, etc, all signed with your private key.
The CA sends you back a certificate of your public key, plus the information that they deemed "yes we will sign this part", plus their signature with their private key (verifiable now through their public key).
Now you have a private key (locked up) + a public key (with signatures and extra information). This still follows hand-in-hand with the thought of "private key-public key".
Now, whether you are on a dev server, or production server, or wherever, you can copy the private key + public key (certificate) to your application server.
Note: I usually generate my private keys on my laptop, disconnected from the network, until the private key is safe. I don't know what logging or backing up is going on inside my Web server, but unless I can trust the platform I am generating a key on, I should consider it potentially compromised.
On your server (Web server, presumably?) you will need to configure your SSL application to point to your public key and private key, and if your private key is password protected, you will need to provide the password to application startup in some manner.
Some applications will require a bundled PEM file containing your certificate, your private key, and any public certificates that correspond to signatures on your certificate. You can bundle these up if you have all the pieces.