Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script.

[1] http://www.w3.org/TR/WebCryptoAPI/

so by doing that you're still trusting the server not to send you evil Javascript that surreptitiously posts off your private key.

it's exactly equivalent from a security perspective, unless you read every line of Javascript, in which case you might as well read the openssl manual instead and generate the CSR yourself.

(note that there's a rarely used <input> keygen type, but to sign the CSR you'd need programmatic access to the private key, again defeating any security properties).