If you have created your subordinate CA in EZCA but you get to the point where you see “Awaiting CA Certificate” in EZCA, it means that the CA has been created in Azure but the certificate has not been signed by your Root CA. If you are using a Root CA that is in EZCA, you can select the Root CA and click on “Create CA” and it will sign the CSR and create the CA in Azure. If you are using a Root CA that is not in EZCA, you will need to sign the CSR in your Root CA and then upload the certificate to EZCA. You can follow these instructions if you are using and ADCS Root CA.
If you are using a Root CA that is in EZCA but it is not showing up in the dropdown, this is usually caused by the Root CA not being the right CA type. The CA must be of the “Subordinate CA Template” type in EZCA to be able to sign the CSR of another Certificate Authority. You can validate the CA type by going to Certificate Authorities and clicking on the CA “View Requirements”, you will see the CA type in the details. If it is not the right type, you can create a new Root CA in EZCA and select the “Subordinate CA” type in step 5. Once you have the right Root CA, you can go back to the Certificate Authority that is awaiting the CA Certificate and select the Root CA and click on “Create CA”.