Considering this thread:
I have a very similar situation. I have a USB eToken 5110 JC (Aladdin) which has an inaccessible private key, since it's the main objective. I can use
pkcs11-tool --module /lib/libeToken.so.9 -l --pin -s -i and it works fine. The libeToken.so.9 is provided by the SAC 9.1 (Safenet Authentication Tool) driver. So far so good.
My problem is: I need to generate certificates and sign them with this eToken. I tried to use the pkcs11 engine with openssl with no success. Maybe due misconfiguration (I tried https://github.com/OpenSC/libp11 how to, but I've got many errors, and I've given up)
I tried to use gpg but I get errors while learning card.
Since I can easily export certificates and public keys from USB Token, the tip of Valentin Bossi sounds good, since I could run
openssl x509 -force_pubkey. Is it correct so far?
What will be the problem of doing this? I know that signing is a process of generating a hash of some data and encrypt it with a private key. When some data is sent to someone with its signature, the recipient will check what was the hashing algorithm, then generate a hash of the data with the same algorithm, and compare to the decrypted hash data with the sender's public key, am I right?
So when generating a certificate, no matter if the data came from a CSR or stdin, the signature made via public key would not assure digital signing, since anyone could get this public key and generate certificates on behalf the eToken owner.
So, what now? What have I got wrong?
Encrypted data with a private key can be decrypted with its public key and vice versa. But I didn't know that it's possible to encrypt and decrypt by using the same key (since the keys are asymmetric).