GenerateCSR user scenario

The step where you take a CSR and provide it to a CA is outside the scope of Redfish. The response for the GenerateCSR action contains the CSR string. However this is then sent to your CA is up to you; ince everyone has a different infrastructure for managing this, Redfish doesn't specify how this is done. Once your CA returns the signed certificate, you can install it on the appropriate collection.

The reason "CertificateCollection" is one of the parameters is so the manager can sanity check the GenerateCSR parameters for additional restrictions based on the target collection. For example, there might be a certificate collection in one location that only supports RSA keys, but a different collection on the same service supports both RSA and elliptic curve keys. This could be because the end device consuming the certificate has different capabilities than other devices on the service.

Generally speaking, the UI for the managers I've seen don't do anything internal with the CSR, other than saving a copy of the key-pair generated with the CSR. Their UI typically contains a pop-up form where the user fills in the details, and the UI is updated with the CSR string. Users copy this string from the UI and send it to their CA as they need to based on who their CA is.

BMCs are not authorities, so there's no need for the BMC to produce a CSR and sign it themselves; doing this defeats the purpose of producing a CSR from an entity like a BMC. This is more like a self-signed certificate where an authority is not involved.