Document how to generate certificates signed by a chain of CAs