Right Way to Implement Multiple Intermediate CAs in CFSSL

Hello,

I have a usecase where I need to set up multiple intermediate CAs signed by a single root CA. The goal is to expose these intermediate CAs **as API endpoints to issue new leaf certificates**. I'm wondering whether I need to run multiple instances of CFSSL or use the multirootCA binary for this purpose.

Additionally, if I opt for the multirootCA binary, I'd like to know whether I need to modify the config file and restart the multirootCA binary every time I create a new intermediate CA. Ideally, I'm seeking a setup similar to HashiCorp Vault PKI.

Any guidance or suggestions on how to achieve this would be greatly appreciated. Thank you!

I tried something like this in cfssl
root-ca-config.json
```
{
"signing": {
"default": {
"expiry": "8760h",
},
"profiles": {
"intermediateCA": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "8760h",
"ca_constraint": {
"is_ca": true
}
},
"leafCertificateForCustomer1CA": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "50h",
"paths": {
"private_key": "/path/to/customer1CA/key.pem", # something like this possible?
"certificate": "/path/to/customer1CA/cert.pem" # If this is possible, how do I make it dynamic? assume a new issuing CA is created, I want to generate a leaf certificate from that, i don't want to reconfigure and restart the server
}
}
}
}
}

```

Start with the multirootCA entry point and the root-ca-config.json example in the issue. Check the existing documentation and implementation for how multiple intermediate CAs and API-backed leaf issuance are supported, including whether configuration changes require a restart. Done means the supported setup and its limitations are clearly documented.

Written by the indexing model from the issue text.