Configure Trusted and Compliant Email Sending

The CSR itself is just the file Salesforce generates when you click Create CA-Signed Certificate under Certificate and Key Management. Sending it to "the certificate authority of your choice" means submitting that CSR to an actual external CA - DigiCert, Sectigo, GlobalSign, or whichever provider your org already has an account with. Their site will have an option like "submit CSR" or "order SSL/TLS certificate" where you paste in the CSR content, go through their domain validation, and they email back a signed certificate file (.crt or .pem). Once you have that, go back to the same certificate record in Certificate and Key Management and click Upload Signed Certificate to finish the exchange. If you don't already have a CA account, most of them offer a free trial or short validation cert that's enough to complete this step.