Команды:
write-output "01" | out-file -append -encoding ASCII "serial"
out-file -append -encoding utf8 "index"
.\openssl genrsa -out "intermediate.key"
.\openssl req -new -sha256 -config "cnf.cnf" -key "intermediate.key" -out "intermediate.csr"
.\openssl ca -config "cnf.cnf" -extensions v3_intermediate_ca -days 2650 -batch -in "intermediate.csr" -out "intermediate.crt"
В конфиг добавить:
[ CA_default ]
certs = ./
serial = serial
database = index
new_certs_dir = ./
certificate = root.crt
private_key = root.key
[ v3_intermediate_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @alt_names
Или воспользуйтесь скриптом:
https://p.sicp.me/dst6M 
