Order the steps a system administrator follows to obtain a signed TLS certificate from a Certificate Authority (CA), from earliest to latest.

### The order 1. **Generate the CA private key and create its self-signed certificate.** The issuer needs its key and certificate before it can issue a server certificate. 2. **Generate the server private key.** The server needs its own key pair before it can make a request. 3. **Create and sign the server's Certificate Signing Request (CSR).** The request uses the server's public key and subject information and is signed with the server's private key. 4. **The Certificate Authority (CA) signs the request and writes `conestoga.crt`.** The CA can issue the certificate only after it receives the request and has its own signing key available. ### The concept The workflow separates key creation, request creation, and certificate issuance. The CA key belongs to the issuer, while the server key belongs to the server. The CSR is the handoff between them: it carries the server's public key and requested identity, not its private key. The final certificate is produced by the CA and leaves the server's private key unchanged. ### Terms - **CA**: Certificate Authority. The certificate issuer. - **CSR**: Certificate Signing Request. A signed request containing a public key and subject information. ### Remember Create the issuer's signing materials and the server's key before asking the issuer to sign the server's request.