You can create a certificate signing request in the same way as a root certificate, but skipping the -x509 and -days options:
openssl req \
-keyout .key \
-new \
-nodes \
-out .csr \
-sha256

I left «challenge password» and «optional company name» blank.