K8s certificate creation

Hi,
If I have a multi-node cluster, in which path/node the admin should generate ALL the public/private keys to be used for authentication purposes between different modules.
Is it that every worker and master node must generate these certificates separately using openssl
or
is it also allowed that admin generates ALL the keys in a specific node e.g. may be a worker node or may be a master
or
is it also allowed that admin generates ALL the keys from a different linux computer which doesnt have any relationship with k8s cluster.

Can you please respond @Tej-Singh-Rana