Issues signing intermediate CA csr

Good afternoon,

To explain my setup, I'm running a POC with CFSSL whereby we have a single root CA running under CFSSL multiroot with several signing profiles configured as below. We have a requirement such that when we bring a new customer onboard, we generate a new openssl key and CSR, then send on to multiroot for signing using a "CA" profile to return us a certificate we can then use as an intermediate for that customer. The issue I'm having is that try as I might, I cannot get multiroot to issue a certificate that can be used as a CA, but it does adhere to the rest of the specified usages for that profile... any clues??

`{
"ca": "",
"ca-key": "",
"signing": {
"default": {
"auth_key": "key1",
"expiry": "2160h"
},
"profiles": {
"server": {
"auth_key": "key1",
"usages": [
"signing",
"key encipherment",
"server auth"
],
"expiry": "2160h"
},
"client": {
"auth_key": "key1",
"usages": [
"signing",
"key encipherment",
"client auth"
],
"expiry": "2160h"
},
"client-server": {
"auth_key": "key1",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "2160h"
},
"customer-ca": {
"auth_key": "key1",
"expiry": "87600h",
"ca_constraint": {
"is_ca": true,
"max_path_len":1
},
"usages": [
"key encipherment",
"cert sign",
"signing",
"crl sign"
]
}
}
},
"auth_keys": {
"key1": {
"key": "",
"type": "standard"
}
}
}`

I have been successfully using multiroot as a signer for server and client certs using an openssl generated CSR so I'm not sure what's happening here. I did think that it was possibly due to the type of key I was generating, so changed to an ECDSA key with a curve known to multiroot but alas, no CA certificate, so can only assume I have an issue with my config.