Yes, the cert treats each as individual domains - with the www is one, without the www is another. Choose either one you want for your cert, you will be able to redirect or use rewrite to take make it transparent to your visitors.
Clearly, you want visitors to be able to use an SSL connection whether they visit example.com or www.example.com (http://www.example.com). To enable this functionality, you can use Apache rewrite rules in a custom .htaccess file.
The following lines demonstrate how to redirect visitors who enter a domain name without the www prefix to a secure connection. With these settings enabled on your web site, visitors who go to example.com or www.example.com (http://www.example.com) (where example.com represents your domain) both obtain an SSL connection:
RewriteEngine on
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www (https://www).%{HTTP_HOST}/$1 [R=301,L]
A CSR or Certificate Signing request is a block of encrypted text that is generated on the server that the certificate will be used on. It contains information that will be included in your certificate such as your organization name, common name (domain name), locality, and country. It also contains the public key that will be included in your certificate. A private key is usually created at the same time that you create the CSR.
The issuing entity will use a CSR to create your SSL certificate, but it does not need your private key. You need to keep your private key secret. What is a CSR and private key good for if someone else can potentially read your communications? The certificate created with a particular CSR will only work with the private key that was generated with it. So if you lose the private key, the certificate will no longer work.
As to the size - 2048 should be more than adequate - the size here is referring to the amount of encryption offered by the
SSL and therefore is your decision for the security level - here's some info: The bit-length of a CSR and private key pair determine how easily the key can be cracked using brute force methods. A key size of 512 bits is considered weak and could potentially be broken in a few months or less with enough computing power. If a private key is broken, all the connections initiated with it would be exposed to whomever had the key. A bit-length of 1024 is exponentially stronger, however, it is more and more likely to be broken as computing power increases. The Extended Validation guidelines that SSL certificate providers are required to follow require that all EV certificates use a 2048-bit key size to ensure their security well into the future. Because of this, most providers encourage 2048-bit keys on all certificates whether they are EV or not.
Hope this helps.
Lee