Can I create a certificate chain from a root CA

A CA hierarchy is similar to a folder organization with specific rules. Each additional CA increases administrative costs. Each new layer increases certificate chain verification time. Therefore, you need to keep as few CAs as possible and chains as short as possible.

The recommended minimum configuration is two tiers:

Root CA --> Policy/Issuing CA --> End Entities

The root CA should be offline, not connected to any network, using HSM and kept in a secure room. The loss/compromise of the root CA causes the whole PKI to collapse without any chance to revoke it. This is why root CAs typically only issue certificates to other CAs, not end entities. It is off in most cases and only on during certificate renewal and CRL issuance.

Policy/Issuing CAs are built under the root and work directly with end entities (certificate consumers or subscribers). Logically, it is installed near most clients. It's enabled and running 24/7. Physical security is the same as root CA: safe room, HSM (personal or net-hsm), strict physical access to devices. The compromise of issuing a CA is still bad, but recoverable. At least, if only part of the PKI is compromised (a specific chain), you can revoke a compromised CA certificate without having to replace root everywhere.

If you need separate CAs for partitioning:

Root CA --> Policy/Issuing CA 1 --> End Entities
        --> Policy/Issuing CA 2 --> End Entities
        --> Policy/Issuing CA 3 --> End Entities

There is nothing wrong with such a configuration.