Have a ca.conf file with the following contents:

basicConstraints = CA:TRUE 
keyUsage = cRLSign, keyCertSign
[req]
distinguished_name = req_distinguished_name
prompt = no
[req_distinguished_name]
C   = AU
ST  = Victoria
L   = Melbourne
CN  = My Personal Root CA

Have generated root certificate with the following command:

openssl req -x509 -new -sha512 -nodes -key ca.key -days 7307 -out ca.pem -config ca.conf

Have a host.conf file:

[req]
default_md = sha512
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[req_distinguished_name]
C   = AU
ST  = Victoria
L   = Melbourne
O   = My Company
OU  = My Division
CN  = exampledomain.com
[req_ext]
subjectAltName = @alt_names
[alt_names]
DNS.1 = exampledomain.com
DNS.2 = api.exampledomain.com

Created CSR with the following command:

openssl req -new -sha512 -nodes -key host.key -out host.csr -config host.conf

Have host-ext.conf with the following contents:

basicConstraints = CA:FALSE
nsCertType = server
nsComment = "My First Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = exampledomain.com
DNS.2 = api.exampledomain.com

Generated host certificate with the following command:

openssl x509 -req -sha512 -days 45 -in host.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out host.pem -extfile host-ext.conf

Now how do I generate the intermediate certificate? What’s the contents of any conf file(s) and what are the commands?

Any help appreciated.