A hierarchy that has never issued anything is a diagram, not a CA. Prove yours works — end to end, including the part relying parties see.
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
-keyout test.key -subj "/CN=test.example.internal" -out test.csr
curl -sk -H "$A" -d "$(jq -n --rawfile csr test.csr \
'{csrPem:$csr, profile:"leaf", validityDays:90, dnsNames:["test.example.internal"]}')" \
$API/v1/cas/ica-tls/issue
curl -sk -H "$A" -X POST $API/v1/cas/ica-tls/generations/1/crl
curl -sk https://127.0.0.1:8083/crl/ica-tls/1 -o ica-tls.crl
Note what travels where: the CSR carries the subject key, and goca never receives the private half — it stays in test.key on your machine. profile is leaf (the default) or sub-ca; a certificate template controls the actual content. The response returns certificatePem.
The last line matters most: fetching the CRL from :8083 is the relying-party view — the anonymous, secret-free surface the world will actually use.
Now I can issue a certificate and fetch its CRL the way a relying party would.