Not sure if I understand what you are trying to achieve. Could you please elaborate a bit to explain what you’re trying to achieve?
In general the private key would be created when you create a CSR to get a signed certificate and then you upload the certificate onto the server once you receive it. When doing that you also need to upload the root CA and any intermediate CA certificate(s) to the trust store beforehand, otherwise you will not be able to upload the signed certificate.
Why would you do this? For what reason would you create the CSR on the Expressway and include the FQDN of the SSMS server? You should create the CSR on the SSMS server.
I logged into our SSMS and possibly you could get the private key changed by logging in as admin to the CLI and then change to root by "sudo su -".
This is what I see when looking at our server. I have no idea where the certificate info would be, but you can probably figure that out by yourself.
