title: What happens if I have expired additional certificate in the chain with alternate trust path?
body: <p>I have a certificate, issued by Sectigo (former Comodo Positive SSL product). It's in good condition and expires in 1 year and 7 months. This certificate issued by Sectigo RSA Domain Validation Secure Server CA. There are two intermediate certificates in the CA chain, provided by the vendor: the closest Sectigo RSA Domain Validation Secure Server CA and next intermediate USERTrust RSA Certification Authority, which expires on May 30, 2020.</p>
  
  <p>Intermediate USERTrust RSA Certification Authority has very close expiration date and signed by trusted by browsers AddTrust External CA Root.</p>
  
  <p>Meanwhile the closest to my domain certificate intermediate Sectigo RSA Domain Validation Secure Server CA signed by another root with same name USERTrust RSA Certification Authority, but this is different CA certificate than mentioned before. And this root is trusted by common browsers.</p>
  
  <p><a href="https://i.stack.imgur.com/b2Rtk.png" rel="noreferrer"><img src="https://i.stack.imgur.com/b2Rtk.png" alt="Certificate chains"></a></p>
  
  <p>I've tried to check it by ssllabs.com's <a href="https://www.ssllabs.com/ssltest/analyze.html?d=habr.com" rel="noreferrer">checker</a> and I see that today all is ok. But I don't understand about future. What happens after May 30 in case if I leave expired intermediate in the chain? Or is it better to exclude this intermediate from the chain beforehand?</p>