Structure: CertificationRequestInfo (version, subject, SubjectPublicKeyInfo and attributes, usually an extensionRequest carrying subjectAltName and key usage) plus a signature over it with the private key. PEM label: -----BEGIN CERTIFICATE REQUEST-----.
The CA decides what ends up in the certificate: public CAs take the public key and the validated names, and ignore or override most other requested fields. ACME clients send a CSR in the finalize step (RFC 8555 §7.4) whose names must match the order's identifiers exactly. A CSR contains no secrets, but generating it requires the private key, so it should be created where the key will live.
Typical commands: openssl req -new -key key.pem -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com". The CSR decoder checks the signature and shows the requested names, and the CSR generator creates one locally.