... will tell you what key-exchange, cipher, and protocol was used by a website's SSL certificate.
This is wrong. Key exchange method, cipher and protocol are features of the TLS connection and not the certificate. In fact, these parameters are (mostly) independent of the certificate. They depend instead on the capabilities and configurations of the TLS stack in client and server.
The relevant features of the certificate are instead the type and the strength of the key (i.e. RSA-2048, ...), the issuing CA, and the signature algorithm used to sign the certificate (i.e. SHA-256, SHA-1, ...)
I have the .csr, .pem files. I can ask, but I wanna know if there's a way to inspect.
openssl req -text will show you (among other things) the information about the public key for the CSR, while
openssl x509 -text will show you additionally the issuer which signed the certificate and the signature algorithm used.
You don't know from this if the admin used the proper openssl commands to generate the CSR. You don't even know if if he used openssl at all or instead some other tools. You can only see the result.
In the worst case the certificate were generated by using a weak random generator and are thus insecure, like in the case of the Debian random generator bug. But you will not be able to detect any broken random generator just from looking at the single certificate. And you also don't know how well your hosting provider protects the private key just from looking at the CSR or certificate.