Can't sign intermediate CA with PKIAAS

Nitrokeys HSM
1

After successfully uploading my csr and signing it with my root CA, I realize the certificate obtained is a leaf certificate, rather than a CA certificate.

The certificate page http://pkiaas.internal/se/paas/cert/5 shows indeed the following:
image

This is weird. I made new attempts at signing the .csr, carefully checking each step. There is nowhere I could specify if the certificate should be an intermediate CA. I thought maybe PKIAAS doesn’t support overriding the CSR, but the csr specifically requested the following extensions:

                X509v3 Key Usage: critical
                    Digital Signature, Certificate Sign, CRL Sign
                X509v3 Basic Constraints: critical
                    CA:TRUE

There must be something I am missing, but what?

2

Did you define a CA Path Length in the root certificate ?

The portal takes the CA Path Length along the hierarchy to determine if the issued certificate is a sub CA or EE certificate. If you want a Sub-CA underneath a Root-CA you need to set CA Path Length to 1.

3

Indeed, that was the thing. Thank you!