I think you're probably already doing it in as few steps as possible. You cannot have a PFX until after you have both private key and signed CSR, and you cannot have a signed certificate until after the CA has approved your request. (Which may or may not require manual Administrator approval, depending on the certificate template settings.)
However, certreq spirits your private keys away in your certificate store as it generates CSRs, which is why you typically have to complete the certificate request on the same computer from which you generated the request. I can't help but feel that this is at least partly some Microsoft coder's attempts to "protect us from ourselves" because we wouldn't know how to keep our precious private keys private. And I can't really blame them. We'd probably see private keys left dangling around on every web developer's desktop profile on every web server if certreq didn't keep the private keys away from them.
Anyway, I digress, but if you want more flexibility over your private key than certreq gives you, use the OpenSSL command line tool to generate your private keys. (openssl genrsa -out private.key 2048
) Then you can do whatever you want with them without that extra step of having to export them from your certificate store.
