...

During the interactive creation, use a CN like "eduroam Managed IdP Central Issuing CA G1" (you have to do this twice, once for RSA and once for ECDSA).

Immediately after creation, create a new CRL (to assert that there are no revoked certificates at this point in time) and a new OCSP statement for the newly created intermediates:

CA.newCRL

CA.newOCSPStatementForSerial_RSA <serial number in decimal of the new RSA intermediate certificate>

CA.newOCSPStatementForSerial_ECDSA <serial number in decimal of the new ECDSA intermediate certificate>

Specific Instructions to make CAT instance a Managed IdP one

...