A certificate is an object which contains a name and a public key, and which is signed. The certificate authority is the entity who applies the signature: by doing so, the CA states: "this public key is really owned by the guy with that name". Key ownership is defined by control of the corresponding private key.
The certificate request is an object which contains a name and a public key, which you send to a CA. The CA will build the certificate (and then sign it), putting in it the relevant data; in particular, it will put the public key which you sent as part of the request. Of course, the CA will do so only after verifying that it really is your key (I surmise, or at least strongly hope, that, in your situation, the "IT department" has a reasonably reliable way to make sure that the certificate request they received is really the one you sent). Of course, to produce the certificate request, you had to generate a public/private key pair. The private key never left your computer; only the public part was sent to the CA.
By installing the certificate in your machine, right along the corresponding private key, you allowed PHP to do certificate-based client authentication. The main protocol for that is SSL/TLS (thus HTTPS, which is HTTP-over-SSL). When the SSL client connects to the server, they do some cryptography (the "handshake"), and the server may then request a certificate from the client: the client must then send the certificate and use the corresponding private key to answer a challenge from the server (basically, computing a digital signature). The server then validates the certificate (i.e. verifies the signature which the CA applied on it): this certificate tells the server what is your public key, at which point the server can verify your answer to the challenge and, therefore, make sure that it is really talking to you.
Summary: the server authenticates your client by verifying that the client controls a private key which corresponds to a specific public key. The certificate binds that public key to your name. The CA establishes this binding. To produce the certificate, the CA needs to know your public key; your public key is contained in the certificate request that you sent to the CA.