Ok, so the general steps to make a Certificate Signing Request are (as I understand it) as follows:
- Generate a key pair
- Put my identifying information and the public key (or its hash) into a document
- Sign that document (CSR) with the generated private key
- Send the CSR to a CA who will verify that it's me and return a signed certificate with trust chain (possibly)
Since the actual signed certificate is to associate a trust relationship between my public key and my credentials, a certificate cannot be signed without access to the public key or at least a hash of the public key.
Here's the confusion for me: I see that there is a command I can execute in OpenSSL:
openssl req -out CSR.csr -key privateKey.key -new
This supposedly creates a new CSR using only the private key. I cannot see how this can work.
Is the public key or its hash secretly hidden inside the private key file?