I'm trying to learn a bit more about acting as my own CA. I've learned some of the basics so far. Create a root pair, keep your root key safe, private and use it to sign other things.
I'm now trying to learn about intermediate certificates. From what I've read these can act as the CA. So root signs intermediate, intermediate signs server/client certs establishing a chain of trust.
What I don't understand is how or why you would use/need 2 intermediate certificates. I've seen CAs do this where they provide a root cert, 2 intermediate certs and your server cert. How does that work? Why would you want 2?
And lastly, if I'm acting as my own CA how can I perform this? Am I creating 2 intermediate pairs, and if so which do I subsequently use to sign my client/server certs?