How do CAs generate public keys without the private keys?

Question

When creating a CSR so you can later paste it to a CA to generate a signed TLS certificate, you first generate a private key:

openssl genrsa -out your-key.key 2048

With the private key, you can then generate the CSR:

openssl req -new -key your-key.key -out your-request.csr

If you want to extract the public key from the CSR, all examples I've seen require the private key to be present in the openssl command:

openssl x509 -req -days 365 -in your-request.csr -signkey your-key.key -out your-public-key.crt

I assume CAs do something similar to sign the certificates and therefore create a public key. However, when filling the request form you are only asked for the CSR, not the private key.

My question is: how do they do it to create the public cert from the CRT without having the private key?

Answer 1

How do CAs generate public keys without the private key?

CAs do not generate any public keys. They create certificates which contain a requesting party's public key (from the CSR).

---

The private key is not necessary to extract a public key from the CSR. To do it execute:

openssl req -in your-request.csr -noout -pubkey

On the other hand, the command you included in the question (claiming its purpose is "to extract the public key from the CSR"):

openssl x509 -req -days 365 -in your-request.csr -signkey your-key.key -out your-public-key.crt

creates a self-signed certificate.

CA signs the certificate with their private key, not yours, hence they do not need yours.

---

The role of the CA is to provide a proof that a public key belongs to the entity claiming it belongs to.

CA might need to verify the domain of the requestor (domain-validated certificates), it might need to verify the documents of the requestor proving its identity

But CA does not need to verify the private key of the requestor because it's mathematically tied with the public key. If someone encrypts the message with their private key, it will be decryptable only by the corresponding public key.