I am trying to create signed client certificates (clients should be able to use TLS for certain services on our server).

Using these instructions: https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html

I am stumbling upon this error for creating the intermediate certificate:

Error reading certificate request in /etc/pki/CA/intermediate/csr/intermediate.csr.pem
140216770922384:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: CERTIFICATE REQUEST

The csr is created with

sudo openssl req -config /etc/pki/CA/intermediate/openssl.cnf -key /etc/pki/CA/intermediate/private/intermediate.key.pem -new -x509 -sha256 -days 4500 -out /etc/pki/CA/intermediate/csr/intermediate.csr.pem

Result

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

So no

-----BEGIN CERTIFICATE REQUEST-----

The cert should be created with

sudo openssl ca -config /etc/pki/tls/openssl.cnf -extensions v3_intermediate_ca -days 4000 -notext -md sha256 -in /etc/pki/CA/intermediate/csr/intermediate.csr.pem -out intermediate/certs/intermediate.cert.pem

There is probably something wrong with my openssl.cnf, but I have no idea, what exactly.

My v3_intermediate_ca extension:

[ v3_intermediate_ca ]
# https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

The req group in our config file:

[ req ]
default_bits        = 2048
default_md      = sha256
default_keyfile     = privkey.pem
distinguished_name  = req_distinguished_name
attributes      = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options. 
# default: PrintableString, T61String, BMPString.
# pkix   : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only

I am not sure at all, what could have any influence on creating a CERTIFICATE REQUEST.