The official Challenge Promode Arena website provides the official and latest releases of CPMA and CNQ3. PlayMorePromode.org
Note: CDkey is not absolutly needed since it is rarely verified, and there are a tons of them on google
if you want to get rid of the CDKey verification while lauching CPMA.
But some servers are checking it, and you'll be kicked quickly if you don't have a valid one.
If you have a genuine one from your Quake CD or Steam or whatever, you must use it in priority. You can likewise use a key-generator if you have one.
There are some packages containing most of the needed about CPMA and some help.
These have some improvements over quake3.exe, but you can use that just as well.