code: func (v *VaultProvider) SignIntermediate(csr *x509.CertificateRequest) (string, error) {
  	var pemBuf bytes.Buffer
  	err := pem.Encode(&pemBuf, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csr.Raw})
  	if err != nil {
  		return "", err
  	}
  
  	// Sign the CSR with the root backend.
  	data, err := v.client.Logical().Write(v.config.RootPKIPath+"root/sign-intermediate", map[string]interface{}{
  		"csr":             pemBuf.String(),
  		"format":          "pem_bundle",
  		"max_path_length": 0,
  	})
  	if err != nil {
  		return "", err
  	}
  	if data == nil || data.Data["certificate"] == "" {
  		return "", fmt.Errorf("got empty value when generating intermediate certificate")
  	}
  
  	intermediate, ok := data.Data["certificate"].(string)
  	if !ok {
  		return "", fmt.Errorf("signed intermediate result is not a string")
  	}
  
  	return intermediate, nil
  }
docs: // SignIntermediate returns a signed CA certificate with a path length constraint
  // of 0 to ensure that the certificate cannot be used to generate further CA certs.