This issue is largely cause by people still stuffing old root certificates in their certificate chains, and serving that to their users. As a general rule of thumb: 1) You don't need to add root certificates to your certificate chain 2) You especially don't need to add expired root certificates to the chain For additional context and the ability to check using `openssl` what certificates you should modify in your cha…
If some of your clients don't have the UserTrust CA, but do have the AddTrust CA, up until today, you probably wanted to include the UserTrust CA cert signed by AddTrust. Clients with the UserTrust CA should see that the intermediate cert is signed by UserTrust and not even read that cross signed cert, but many do see the cross signed cert and then make the trust decision based on the AddTrust CA.
It's hard to identify clients in the TLS handshake to give them a cert chain tailored to their individual needs; there's some extensions for CA certs supported, but they're largely unused.