Renew Certification Authority in OPENSSL Verify fails - security

Question

I'm in the process of re-emit a ROOT CA (Certification Authority) to fix some information in its fields, but you can imagine that it could be the same if the root Certificate is near to caducity time.
Of course, before do it in production, I 'm doing this in a test enviroment with a easy command line test (in linux).
I used the very good information I've found here Certification authority root certificate expiry and renewal.
I modify the process to make more similar to my own.
I've create a openssl_root.cnf file. I added some fields like
countryName = optional
organizationName = optional
organizationalUnitName = optional
localityName = optional
stateOrProvinceName = optional
telephoneNumber = optional
mail = optional
serialNumber = optional
commonName = optional
and of course, the parameter to ask (for example)
[ req_distinguished_name ]
mail = Email Address
mail_max = 60
telephoneNumber = Please submit yor Telf. Number
telephoneNumber_max = 13
...
the section which is more important to me, the extensions
[root_ca]
# Extensions for a typical CA RAIZ
# It's a CA certificate
basicConstraints = critical, CA:true, pathlen:1
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid
keyUsage = cRLSign, keyCertSign
subjectAltName = DNS.1:mycompany.com,
issuerAltName = issuer:copy
# CRLs & OCSP
crlDistributionPoints = #root_section
authorityInfoAccess = #ocsp_root
certificatePolicies = #PCs
[ root_section ]
URI.1 = https://$root_ip/crl/cacrl.crl
[ ocsp_root ]
caIssuers;URI.0 = http://$root_ip/certificates/cacert.pem
OCSP;URI.1 = http://$root_ip/ocsp
[ PCs ] #Certifification Policy section
policyIdentifier = 1.3.5.8 #fake OID
CPS.1 = http://$ip_local/dpc
CPS.2 = http://$ip_local/policy
userNotice.1 = #notice
after than I do the request with this commands
openssl genrsa -out ca.key 4096
openssl req -new -key ca.key -out ca.csr -config openssl_root.cnf -extensions root_ca -sha384
here I fill the fields of the DN with the information..
and so, I sign the root authority with
openssl ca -days 3650 -in ca.csr -keyfile ca.key -selfsign -create_serial -config openssl_root.cnf -extensions root_ca -out ca.pem
I have now ca.pem (the certificate) and ca.key (the private key)
now I create a Subordinate Certification Authority
openssl genrsa -out subca1.key 4096
obviously, I create a new section in the cnf file for the subordinate authority, name v3_ca
openssl req -new -key subca1.key -out subca1.csr -config openssl_root.cnf -extensions v3_ca -sha384
fill the fields and sign by
openssl ca -days 3650 -in subca1.csr -keyfile ca.key -cert ca.pem -config openssl_root.cnf -extensions v3_ca -out
I have now subca1.pem and subca1.key
If I test it
openssl verify -CAfile ca.pem -verbose subca1.pem
subca1.pem: OK
Now, I gonna do the new (re-newed) authority..
I MUST use the same private key ca.key...
openssl req -new -key ca.key -out newca.csr -config openssl_root.cnf -extensions root_ca -sha384
I put some information "updated" in the fields when fill the questionary, and sign
openssl ca -days 3650 -in newca.csr -keyfile ca.key -selfsign -create_serial -config openssl_root.cnf -extensions root_ca -out newca.pem
if I test now
subca1.pem: C = VE, O = empresa 1, OU = Gerencia Criptografia, L = La Urbina, ST = Miranda, telephoneNumber = 02129889977, mail = pki#empresa1.com, serialNumber = J123453450, CN = PSC Subordinado Empresa 1 PRUEBA
error 20 at 0 depth lookup:unable to get local issuer certificate
I review the public key and is the same, and the SubjectKeyIdentifier and AuthorityKeyIdentifier
openssl x509 -in ca.pem -pubkey -noout
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxxG1bEsUyDU1X31qJJNC
7uBYQhRsNi0dgsvcrIruPiQAcg3pH8Pu/WdnDmIdn/OUV9IvMPa22BPm1zaLZ/HF
EkHJxGdThEpcCtsd2ET0KhqYQ21s78lCyQGMdJvmh/FBLuVBsd7IvxgARqTl2402
4HXv+PavFaANM5AO+UnEjXDHXI0ce560l8s+rivlDjoSZRNGBLEla0wl0Jf6oo8l
fV+m9zMbKsLvScXWsoq+aO6I5BY8WhJtU4vXRRjDVp5t4L6PCnHJpOFL6+jLxeJH
N83FEeNkjw681ZFoB6pFG2QdndzKK0hcRJb1+526GRY97sKBfCOkQgNsTjHoF2ST
SudbWarWmFZg4ofF6wNCt205q6siMJiNM9h67xFUwDFoUTav6m5GdCdgFdgBvODN
zSwc5e4V56bgh5Iyz7CZmTdAVxncy74EqJNV+PjcYnxei2Xb1BaenLyiLzZdk+OY
Wlp+6CQtebeU3nTZfNFpyV3XjkXpZJs5CGAgNTr9wRbtQxKbK/R+DOQoIk/b+g6s
3WfTJ8V7fktIX+vrdOe7vBayXh/Q5AEuNvGH4h0v+ziGZrIL68iTuQdDy/qrivtp
0AB4fVknp+q4ZOXGoLmWFDQjFBmzFFS7aZHCMhwRevp3F3jsWTgYDYEag6IeJVc/
ZH8VjHsthnkI6T/OlBVI3DsCAwEAAQ==
-----END PUBLIC KEY-----
openssl x509 -in newca.pem -pubkey -noout
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxxG1bEsUyDU1X31qJJNC
7uBYQhRsNi0dgsvcrIruPiQAcg3pH8Pu/WdnDmIdn/OUV9IvMPa22BPm1zaLZ/HF
EkHJxGdThEpcCtsd2ET0KhqYQ21s78lCyQGMdJvmh/FBLuVBsd7IvxgARqTl2402
4HXv+PavFaANM5AO+UnEjXDHXI0ce560l8s+rivlDjoSZRNGBLEla0wl0Jf6oo8l
fV+m9zMbKsLvScXWsoq+aO6I5BY8WhJtU4vXRRjDVp5t4L6PCnHJpOFL6+jLxeJH
N83FEeNkjw681ZFoB6pFG2QdndzKK0hcRJb1+526GRY97sKBfCOkQgNsTjHoF2ST
SudbWarWmFZg4ofF6wNCt205q6siMJiNM9h67xFUwDFoUTav6m5GdCdgFdgBvODN
zSwc5e4V56bgh5Iyz7CZmTdAVxncy74EqJNV+PjcYnxei2Xb1BaenLyiLzZdk+OY
Wlp+6CQtebeU3nTZfNFpyV3XjkXpZJs5CGAgNTr9wRbtQxKbK/R+DOQoIk/b+g6s
3WfTJ8V7fktIX+vrdOe7vBayXh/Q5AEuNvGH4h0v+ziGZrIL68iTuQdDy/qrivtp
0AB4fVknp+q4ZOXGoLmWFDQjFBmzFFS7aZHCMhwRevp3F3jsWTgYDYEag6IeJVc/
ZH8VjHsthnkI6T/OlBVI3DsCAwEAAQ==
-----END PUBLIC KEY-----
is exactly the same...
But it doesn't match!
I guess the trouble maybe is in the SubjectKeyIdentifier and AuthorityKeyIdentifier but its match if I review both certificates,
Any help? Thanks