WHM/CPanel Sends Private Key Via Clear Text Email

Why does the WHM panel send me my private key and passphrase for my SSL certificate to my inbox when I generate a CSR? Um... isn't that a bit insecure?

I purchased a Rapid SSL cert from NameCheap who then needed a Certificate Signature Request(CSR) which is generated from WHM.

After generating the CSR, WHM sent me an email that is literally titled 'SSL RSA PRIVATE KEY for *.<domain_removed>.com'

The email not only contains the ----- RSA PRIVATE KEY----- but also my 'challenge password' .

is this supposed to happen? and why on earth would my private key and passphrase be sent via unencrypted email? The only think I can think of is that the WHM panel feature is being used to generate the CSR and is sending me a self-signed cert private key , which I'm not going to use (i'm only going to use the CSR) Even if thats the case, I think it still shouldn't happen, its too confusing for newbies like me and I could just end up using the same passphrase for my actual certificate.

Here are the steps I followed:
1. purchased a RapidSSL from namecheap
2. Clicked 'Activate' in namecheap's SSL dashboard which then asks me for a CSR.

To get the CSR, per Site5's wiki:
1.logged into WHM
2. clicked 'Generate a SSL Certificate and Signing Request'
3. completed the 'create a new cert' form which among other things, asks me for the 'Email address the cert will be sent to'. For all the fields, see the site5 wiki
4. click Create