This may not apply to your situation, but be aware that NetSuite is trying to force folks into doing all their SSL natively in the NetSuite Domain configuration. I have been using CloudFlare for my SSL for years (since before NetSuite even supported it for our Web Store).
This week I received a notice that because my primary domain is proxied through CloudFlare, it's registering as "misconfigured", and they are planning to start blocking traffic if I don't remove CloudFlare as an upstream proxy. I mention as if you are trying to generate a CSR to secure your domain (outside of NetSuite) you may be in for a rough time.