App Certificate signed using the Intermediate CA

openssl genrsa -out app1.key 2048
# password protect key: openssl genrsa -out -des3 app1.key 2048 
openssl req -new -key app1.key -out app1.csr \
  -subj "/C=US/ST=CA/L=Santa Clara/O=MyOrg/OU=AppOU/CN=app1.myorg.com/emailAddress=app1@myorg.com" 
openssl x509 -req -in app1.csr -CA interca.crt -CAkey interca.key -out app1.crt - sha384 \
  -days 365 -CAcreateserial -extensions SAN \
  -extfile <(printf " [SAN]\nbasicConstraints=CA:false\nsubjectAltName=DNS:app1.myorg.com,DNS:app1- 1.myorg.com,IP:192.168.10.21,IP:192.168.10.22")

Append files app1.crt and interca.crt to make a combined certificate and use the combined certificate in your application. The root CA must be installed as a trusted root CA on your client machines.