Você está correto. A integridade de ambos os itens pode ser validada pelas assinaturas digitais na solicitação (assinada com a chave privada do solicitante) ou pelo certificado (assinada pela chave privada da CA).
Editar:
RFC 2986, seção 3, descrevendo solicitações de certificados PKCS # 10:
3. Overview A certification request consists of three parts: "certification request information," a signature algorithm identifier, and a digital signature on the certification request information....
1. A CertificationRequestInfo value containing a subject distinguished name, a subject public key, and optionally a set of attributes is constructed by an entity requesting certification. 2. The CertificationRequestInfo value is signed with the subject entity's private key. (See Section 4.2.)
e página 5:
The components of type CertificationRequestInfo have the following meanings:...
attributes is a collection of attributes providing additional information about the subject of the certificate. Some attribute types that might be useful here are defined in PKCS ... certificate revocation. Another example is information to appear in X.509 certificate extensions (e.g. the extensionRequest attribute from PKCS #9). The values of type
Certificados RFC 5280 re: x.509:
4.1.1.3. signatureValue The signatureValue field contains a digital signature computed upon the ASN.1 DER encoded tbsCertificate. The ASN.1 DER encoded tbsCertificate is used as the input to the signature function. ... 4.1.2. TBSCertificate The sequence TBSCertificate contains information associated with the subject of the certificate and the CA that issued it. Every TBSCertificate contains the names of the subject and issuer, a public key associated with the subject, a validity period, a version number, and a serial number; some MAY contain optional unique identifier fields. The remainder of this section describes the syntax and semantics of these fields. A TBSCertificate usually includes extensions.