When creating a CSR so you can later paste it to a CA to generate a signed TLS certificate, you first generate a private key:
openssl genrsa -out your-key.key 2048
With the private key, you can then generate the CSR:
openssl req -new -key your-key.key -out your-request.csr
If you want to extract the public key from the CSR, all examples I've seen require the private key to be present in the
openssl x509 -req -days 365 -in your-request.csr -signkey your-key.key -out your-public-key.crt
I assume CAs do something similar to sign the certificates and therefore create a public key. However, when filling the request form you are only asked for the CSR, not the private key.
My question is: how do they do it to create the public cert from the CRT without having the private key?