You create your own private key (or rather, the client does that for you, if you use the official one) and send them a Certificate Signing Request (CSR) which o

You create your own private key (or rather, the client does that for you, if you use the official one) and send them a Certificate Signing Request (CSR) which only includes your public key. The private key stays on your server.