@fdinardo That should be correct. You should see the node’s certificate signed by the Intermediate certificate.
Did you verify the files inside the containers? Do you get the correct openserach.yml and cert/key files in both OpenSearch containers?
Have you noticed any read file permission errors in the OpenSearch logs during the startup?
Did you add the RootCA of the admin certificate to the root-ca.pem?
If the RootCAs are different then the root-ca.pem should look like the below example.
-----BEGIN CERTIFICATE-----
<node RootCA certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<admin RootCA certificate>
-----END CERTIFICATE-----