Could you provide more details. What do you mean by "create the certificate and mail it to a 3rd party over the internet"? Are you talking about client certificate?
Cient should be requesting certificate remotely from your certificate authority. Certificate request would be generated based on the private-public key pair that is stored locally so that the private key stays safe. If you need to generate and send client certificate over the internet that you would need to export it including the private-public key pair (PFX file). But I would not recommend the later approach.
Well, Maybe I just don't understand what are you up to. So let me know what exactly are your steps and goals for the non-working scenarioj.