If your OpenSSL command is this:
openssl req -new -newkey rsa:2048 -nodes -sha256 -keyout SUBDOMAIN_DOMAIN_TLD.key -out SUBDOMAIN_DOMAIN_TLD.csr
SUBDOMAIN_DOMAIN_TLD.csr will be generated in the same folder/directory you happen to be in. The
-out options are simply setting a filepath so
SUBDOMAIN_DOMAIN_TLD.csr will be written to your current filepath.
Remember, tools like OpenSSL are not magic. The create text files that might contain what appears to be magical hashes. But on an operational level they are just text files with data in them. Where you place those files are up to you.
So if you create these in your own user folder and want to use them for SSL on an Apache web server, then you would have to decide on a solid, safe and final place to place them for reference.
In the case of the CSR (Certifcate Signing Request) that would only really be used to sign the certificate with the entity you are purchasing an SSL certificated from; it’s just a digital signature. You sign the certificate with the CSR via whatever web interface they have, after jumping through some hoops and paying them you’ll get CRT and possibly need a PEM file—like on services such as Gandi—and setting those with your your KEY file will allow you to enable SSL in Apache… Or whatever application you are using the certificate with.