I know that OpenSSL requires the CSR to be signed for a reason: to assure CSR validity, the fact that it was requested by the actual private key owner of the attached public key. It is absolutely fine, but in theory a CA can assure validity in other ways, especially when the CSR is never in transit. This is the case with self signed certificates, e.g. with locally issued and used company certs. In my case I would like to create certs without the private keys because they are generated on smart cards and they cannot be exported ever. And no, cards do not generate CSR during key generation.
I have not found any option in OpenSSL create a certificate from the sole public key. Despite in theory it is very well possible.
Is there an option in OpenSSL to do so? Any other means? I need to create X509 certificates.