The phrasing of your question is a bit odd, because you're not really asking about the difference between a certificate and a CSR (which are of course fundamentally different entities) but rather two different workflows for obtaining a certificate:
- If you have your own CA, the tool you use lets you issue certificates directly without creating a CSR first. The certificate will be signed by your CA.
- Alternatively, when you want a certificate for a particular identity and public key, the tool lets you create a CSR which can then be sent to some CA. The resulting certificate will be signed by that CA.
From a conceptual standpoint, there's no need for a CSR in either case. If you have your own CA, then you can create any certificate you want. You just take a public key, define the certificate's subject and then sign the certificate with the CA's private key. Professional CAs could also choose to skip the CSR step and ask you to provide your public key and your identity information through other means (e. g. a web form) -- unless there's a specific policy or infrastructure which requires the use of CSRs, of course. This has nothing to do with needing the private key of the certificate requester. The CA never needs that key for issuing the certificate (leaving aside those rather strange services which generate a key pair for you).
The purpose of a CSR is to cryptographically bind a subject (with a common name, country, organization etc.) to a public key, so that there are two guarantees:
- The requester does in fact have the private key associated with the public key.
- The subject data has in fact been provided by the requester.
If you simply want to create your own certificate on your own machine, those guarantees don't matter much. However, in more complex scenarios where the CA is a separate entity, CSRs make sense. But again, in principle, CAs don't have to use CSRs.