client bases authentication via certificate signed by ROOT CA - ssl

Question

I have generated a ROOT CA and can successfully use it for client based authentication:
openssl req -x509 -sha256 -newkey rsa:4096 -subj "$SUBJECT" -days 3650 -keyout root_ca.key -out root_ca.crt
openssl req -newkey rsa:4096 -nodes -sha256 -subj "$SUBJECT2" -out client.csr -keyout client.key
openssl x509 -req -sha256 -in client.csr -CA root_ca.crt -CAkey root_ca.key -CAcreateserial -out client.crt -days 730
openssl pkcs12 -export -nodes -in client.crt -inkey client.key -out client.p12 -passout pass:
(in $SUBJECT2 the CN is different)
In webserver (apache):
SSLVerifyClient on
SSLCACertificateFile conf/root_ca.crt
root_ca.crt imported as authority and client.p12 as personal certificate in the browser (firefox, chromium)
Now I have created an intermediate CA:
openssl req -sha256 -newkey rsa:4096 -subj "$SUBJECT" -keyout intermediateCA.key -out intermediateCA.csr
openssl x509 -req -sha256 -in intermediateCA.csr -CA root_ca.crt -CAkey root_ca.key -CAcreateserial -out intermediateCA.crt -days 1095
and use it (intermediateCA.crt) in the webserver instead of the root_ca.crt.
Unfortunately the web-browser (and webserver) are reporting errors when trying to access the website using client.p12.
P.S.:
Later I want to use client certificates sign by the intermediate CA for certain users. Using client_intermediate.p12 one should be able to access only the web-side with the intermediateCA.crt while other users using only client.p12 should be able to access websites using intermediateCA.crt and websites using root_ca.crt.
openssl req -newkey rsa:4096 -nodes -sha256 -subj "$SUBJECT" -out client_intermediate.csr -keyout client_intermediate.key
openssl x509 -req -sha256 -in client_intermediate.csr -CA intermediateCA.crt -CAkey intermediateCA.key -CAcreateserial -out client_intermediate.crt -days 730
openssl pkcs12 -export -nodes -in client_intermediate.crt -inkey client_client_intermediate.key -out client_intermediate.p12 -passout pass: