Hello rojak,
Thank you for posting in Q&A forum.
Usually, because the intermediate certificate is not in "Intermediate Certification Authorities", or the root certificate is not in "Trusted Root Certification Authorities".
For example 1:
root-CA certificate should be in "Trusted Root Certification Authorities" and a-subCA-CA should be in "Intermediate Certification Authorities".
For example 2:
root-CA certificate should be in "Trusted Root Certification Authorities"
I hope the information above is helpful.
If you have any questions or concerns, please feel free to let us know.
Best Regards,
Daisy Zhou
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.