Setting up CAs for PKI - Root, Intermediate and/or Issuing CAs?

[ITOperative]

Good morning!

I'm a little lacking on the depth of CAs than I'd like, but I'm hoping to create a PKI for both extending to other VMs and machines, as well as authenticating VPN, etc.

I know in a proper 3-tier PKI, you would have Root CA > Intermediate CA(s) > Issuing CA(s).
From what I've read, an Intermediate CA creates certificates for other CAs, whereas an issuing CA does the typical issuing for the end of the chain.
I do know that one typically keeps a Root CA offline. I don't know if an Intermediate CA can also be used as the issuing CA or not.

So first, in TrueNAS Core, can an Internal CA be used as a Root CA, or should I make a separate Root CA and import it as an External CA?
Next, looking at Internal CA, I don't see the option to select a certificate to base it off of, so how would one create a subordinate CA, would I just use an Intermediate CA to sign, or is this functionality beyond what TrueNAS provides?

I do intend to use this both as a standard CA for anything in my network that requires a cert, but would also like to use it for OpenVPN.
Would I set the profile to Openvpn Root CA, or just CA?

Finally, do I need to enable any extension in the Root CA that I'd want on subordinate CAs, such as Extended Key Usage, or can I do that entirely in the subordinate CA to restrict security on the Root CA itself?

Thanks for any time and assistance with this!
I feel know just enough to get by with PKI for most of my needs, but I don't fully grasp the setup and want to ensure I do it right.

 

[danb35]

I don't know if an Intermediate CA can also be used as the issuing CA or not.

It often, but not always, is.

I do know that one typically keeps a Root CA offline.

That's a good security measure. I don't think it's practical if you plan on your NAS as the root of your entire PKI.

IMO, trying to use your NAS as a CA just isn't a good idea, as that feaure's pretty poorly-implemented in TrueNAS. Much better to use a separate device, like this:

Build a Tiny Certificate Authority For Your Homelab

Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG.

smallstep.com

 

[ITOperative]

Well I primarily plan it for personal use, but I'll definitely keep that in mind!
For the time being I've made my CA and intermediate CA, and I plan to feel it out for a bit..
But if need be, I may spin up a super lightweight VM to handle the server portion of it.

In the meantime, I did a cert + key export on both the root and intermediate CAs once I got them working, and placed that on cold storage.
That way if I migrate off of TrueNAS for my CA use, I can easily import it elsewhere without interruption.