I'm new to commercial SSL certificates and would like to know if a CSR that I generate is safe to send via email?
As the CSR only contains your public key: No, it's not dangerous to send it by email or publicize it in any other way. The only thing you can basically do with it is to generate certificates for that public key. Don't send your private key to anyone however.
Also, I'm not aware of any commercial SSL provider that wants to receive the CSR by email. Are you sure there isn't some text input field in their web interface?
Goodness. No it is not safe to send the CSR by email. The comments above regarding the lack of any secrets in the CSR are fine but they miss the point.
A certificate authority, by signing a CSR and thus issuing a certificate, is stating that the contents of the CSR are true. As email is an insecure transport then there is no guarantee per se that the CSR received by the CA is the same as the one sent. An obvious compromise is that the email is intercepted, the CSR is changed in some way, or replaced, and and as the CA has no way of knowing that has happened signs something saying it is true when it is not what the requestor asked to be signed.
That is why any reputable CA will provide a web form secured by TLS in order to transfer the CSR securely.
The only case where email is acceptable is - as one of the comments above refers - if the email is verifiable and the content known to be unchanged. This is achieved generally by signing the email (PGP, S/Mime etc). Other options might be to encrypt the CSR and provide out-of-band and secure exchange of the encryption secret.
It's odd that a certificate authority asks you to send your CSR through email.
Generally, they asks you to copy/paste the CSR in a textarea on their website when you subscribe, while being connected in HTTPS.
Now, as explained in Wikipedia :
The CSR contains information identifying the applicant (such as a distinguished name in the case of an X.509 certificate), and the public key chosen by the applicant.
That means it's safe to send this by email because what is important in a PKI infrastructure is the private key, that you must keep to yourself.