Product and Software: This article applies to all Aruba controllers and ArubaOS versions.
Yes, you have to generate a CSR on each of the controllers.
When you generate a CSR on the controller, it stores the private key on the controller and delivers the public key, which is signed from the CA.
Mapping the certificates to the profiles can be done only on the master controller. So when you upload the certificate, make sure to use the same certificate name on all the controllers. Also, upload the certificates on the other controllers locally.