From the wikipedia link:
Before creating a CSR, the applicant first generates a key pair,
keeping the private key secret. The CSR contains information
identifying the applicant (such as a distinguished name in the case of
an X.509 certificate) which must be signed using the applicant's
The CSR contains the public key + additional information. It is signed (not encrpyted!) with the private key to proof authenticity (hint: can be verified with the public key).
Proofing that you own the domain or are the person that this certificate is issued for is a different, separate process. Domain validation is easyily verified by sending an email to the admin of the domain. Enhanced Validation (EV) the green bar, takes some physical proof and is a more extensive process therefore more expensive. Dito for certs issued to a person.