How to correctly generate a CSR to attach an SSL certificate to a website?

Question

OpenSSL

How to correctly generate a CSR to attach an SSL certificate to a website?
Various articles about installing SSL certificates describe different ways to generate a private key and CSR. For example, here are two different options: a) openssl req -nodes -newkey rsa:2048 -keyout myserver.key -out server.csr and b) openssl genrsa -des3 -out www.mydomain.com.key 2048
1) How to correctly generate CSR and private key?
2) What is the difference between the CSR and key generation commands a) and b)?
3) Do I need to set a password when generating the CSR and key?
4) Does the use of a password for the private key reduce the site's vulnerability to attacks?