A single self-signed CA is fine for a lab, but the moment real workloads trust it you need the standard production shape: an offline root that signs nothing but intermediates, and an issuing CA that does the daily work. This tutorial builds both with nothing but OpenSSL.
Why two tiers
The root key is the one secret you cannot rotate without touching every trust store. Keeping it offline — signed once, then locked away — means a compromised issuing CA is a bad week, not a company-ending event. You revoke the intermediate, issue a new one from the root, and move on.
Creating the offline root
Generate the root key on an air-gapped machine, self-sign a long-lived certificate with basicConstraints = critical, CA:true, pathlen:1, and never let the key touch a networked filesystem.
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 \
-out root.key
openssl req -new -x509 -key root.key -days 7300 \
-config root.cnf -extensions v3_root -out root.crtThe issuing intermediate
The intermediate gets pathlen:0, CRL and OCSP URLs baked into every certificate it signs, and a much shorter lifetime. Sign its CSR with the root — this is the only ceremony the root key ever performs.
Operational wiring
Publish the CRL on a schedule, stand up an OCSP responder, and script issuance so nobody ever runs openssl ca by hand against production. The hierarchy is only as trustworthy as the process around it.