In Openssl after a root CA has ben generated here are the following commands to create an intermediate CA;

as root

/etc/pki/tls/misc/CA –newca

/etc/pki/tls/misc/CA -newreq

some Generic Certificate Authority (usually a server)

Enter Enter

/etc/pki/tls/misc/CA –signCA

PassPhrase: Demo

newreq.pem is key with CSR request inside

newcert.pem is certificate

new_to_open_ssl is offline

How to Create Self-Signed SSL Certificates with OpenSSL

http://www.xenocafe.com/tutorials/linux/centos/openssl/self_signed_certificates/index.php