Create an issuing CA under a root
Create an intermediate CA that signs your day-to-day certificates.
As pki-admin
Open /cas
Click New CA
Select "Intermediate" in Type
Fill Subject CN with "Lab Issuing CA"
Choose the parent CA (here Lab Root CA)
Choosing Intermediate reveals the Parent CA picker
Click Create CA
