code: func (v *VaultProvider) GenerateIntermediate() (string, error) {
  	csr, err := v.generateIntermediateCSR()
  	if err != nil {
  		return "", err
  	}
  
  	// Sign the CSR with the root backend.
  	intermediate, err := v.client.Logical().Write(v.config.RootPKIPath+"root/sign-intermediate", map[string]interface{}{
  		"csr":    csr,
  		"format": "pem_bundle",
  	})
  	if err != nil {
  		return "", err
  	}
  	if intermediate == nil || intermediate.Data["certificate"] == "" {
  		return "", fmt.Errorf("got empty value when generating intermediate certificate")
  	}
  
  	// Set the intermediate backend to use the new certificate.
  	_, err = v.client.Logical().Write(v.config.IntermediatePKIPath+"intermediate/set-signed", map[string]interface{}{
  		"certificate": intermediate.Data["certificate"],
  	})
  	if err != nil {
  		return "", err
  	}
  
  	return v.ActiveIntermediate()
  }
docs: // GenerateIntermediate mounts the configured intermediate PKI backend if
  // necessary, then generates and signs a new CA CSR using the root PKI backend
  // and updates the intermediate backend to use that new certificate.