An alternative would be to output an OpenSSL command using the data entered in the form that the user can run locally to generate the CSR and private keys.

This would be similar to what DigiCert's CSR generator does: https://www.digicert.com/easy-csr/openssl.htm