A safer version might instead generate the openssl(1) commands needed to generate the files on your local machine.
Smart.
This would be similar to what DigiCert's CSR generator does: https://www.digicert.com/easy-csr/openssl.htm
(I wonder how many private keys they'll end up with. This is a cheaper if somewhat less universal attack than compromising a CA directly.)
Feature request: you might want to let Javascript generate the keypair so that people stop whining about letting someone else generate the private key. Although a valid argument, this isn't going to be used in production environments anyway.... Or is it, guys?!
Feature request: Let people set the key size. Also inform people about the key size (why 4096 is probably overkill at the moment).
Bug: You don't actually mention what the tool does. It generates some sort of certificate, but people will probably be under the impression that it will work instead of spawn another one of these: http://www.page-zone.com/SSL-warning-cpanel.jpg
It's making CSRs, not certificates.
But yes, here you are right, the cert is generated by the server in this case.
it's exactly equivalent from a security perspective, unless you read every line of Javascript, in which case you might as well read the openssl manual instead and generate the CSR yourself.
(note that there's a rarely used <input> keygen type, but to sign the CSR you'd need programmatic access to the private key, again defeating any security properties).
Let me be the first to offer a positive suggestion: csr.io should keep doing exactly the same thing, but on the "results" page where it shows the key and CSR now, also generate and show the equivalent OpenSSL commands for someone to generate a key on their own machine. These commands should be able to be blindly copy/pasted into any Mac/Linux command prompt where OpenSSL is installed.
