By the way, did you import the CA_chain.pem
in the browsers?
I thought browser only needs to have the self signed root CA. If I
have intermediate.pem installed, then of course things go as
expected; but this should be a certificate chain as provided by
Apache.