Tell me where I get wrong.

1. I created CSR with CA:TRUE and send it to the server. 2. The server signed it and returned me a certificate. 3. I use the given certificated with CA:TRUE from the server and sign a new certificate with the username administrator. 4. I install the certificate on my browser and should get in.

All of the above sounds great. however, it is still(!!!) not working for me. Where am I going wrong

Make sure you install the administrator certificate with its private key... Bundle the private key with the cert.

How do you even get the CA private key

Can you post how you did it?

I have the csr and the private key of the administrator but I don't know how to sign it on behalf of the root certificate, any idea?

send them csr that it's CA=TRUE. then you recieve a cert you can sign others.. so sign adminstrator cert by yourself

But when I signed the csr with a valid crt from a downloaded p12 I got ssl error on the website

And I don’t have the CA praivet key

Can you explain step by step how you have done it? :) If you change to CSR and key in the request to self-generated, it still says username already exists.

on the other side, if I create my own certificate using custom CSR and key, I still cannot sign it with website CA (taken from original p12 file) since I do not have the private key.