An empty CA list and a New CA button — what do you actually create? Two things, in order: a root that signs only CAs, and an issuing CA that signs your certificates.
In the console: CAs → New CA. Create a self-signed root first — pick an algorithm; slh-dsa-sha2-192s is the conservative post-quantum root choice, ECDSA P-384 the classical one. Then create an issuing CA with issuerRef pointing at the root. The same works over the API:
curl -sk -H "$A" -d '{"name":"root-g1","commonName":"Example Root CA G1",
"organization":"Example","algorithm":"ecdsa-p384","validityYears":20}' $API/v1/cas
curl -sk -H "$A" -d '{"name":"ica-tls","commonName":"Example TLS CA G1",
"organization":"Example","algorithm":"ecdsa-p256","validityYears":10,
"issuerRef":"root-g1"}' $API/v1/cas
For production hierarchies, prefer running CA creation as a ceremony — plan, quorum approval, execute, with a hash-chained transcript (frame 36). The direct path above creates immediately and is fine for evaluation.
Now I can create a two-tier hierarchy and name my algorithm choice for each tier.