The CSR contains the digital signature of the public key that is requesting the certificate. So you absolutely need the private key to create a CSR. How would you create a CSR with just a public key?
Yeah, go read it:
The
certification request information consists of the entity's
distinguished name, the entity's public key, and a set of attributes
providing other information about the entity.> 2. The CertificationRequestInfo value is signed with the subject entity's private key. (See Section 4.2.)
I wonder what this means? Hmm...
Do you really not know what you're talking about or are you trolling at this point?