So as it says, how am I supposed to allow Internal CA to sign CSR?
This would be for scenarios where you cannot easily replace a private key for a client so the preferred process uses CSR's instead.
Is it even possible?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
There are a number of openssl ca subcommand examples on the manpage. The standard method of signing a CSR is the same, regardless of how you generate it or what you generate it from. For example, signing using the default extensions for this CA's config:
openssl ca -in csr.pem -out newcert.pem
This requires the internal CA already be set up for cert signing, and the internal CA's certificate be added to the trust root stores of any clients that may need to validate it.