A real CA will only issue you one valid X.509 cert for each distinct "subject" (DN) or subject/SAN combination at any point in time. A wildcard is generally intended for use on multiple systems. Some CAs used to charge an additional "license" per-device, check the small print.
The key and the cert are tied to each other (this is the assymmetric cryptographic part that I'm not even going to begin to explain here). Each certificate has (in theory) exactly one matching private key, so you cannot have multiple distinct keys and a common certificate.
The approach is:
- you don't generate a CSR on each system individually
openssl to generate a key and a CSR, follow your chosen CA's instructions
- submit CSR, pay $$$ and wait
openssl to convert the
.crt as required by the other platform (DER, PEM, P12/PKCS#12) etc
- make sure to protect your key at all times on all platforms
- import the key/cert pair on each system, they all share the same pair, albeit likely imported in different formats
One key, one CSR, one cert -- multiple installs.
CAs always ask the platform, mostly to give you a suitable file format (cert and bundle), but I suspect also to workaround known issues (e.g. exact certificate attributes and formats, DN name format, X.509v3 extensions). In general you should be able to use
openssl, tell the CA you use "Apache/mod_ssl", and convert.