Subject Name (CN)  Legacy Root (CN) Expires Comodo, Comodo RSA, AAA, USERTrust RSA → AddTrust External  2020 May Network Solutions  → UTN-USERFirst  → AddTrust External  2020 May WoSign  → UTN-DATACorp  → AddTrust External  2020 May DigiCert Trusted G4  → DigiCert Global  → Baltimore CyberTrust  2025 May DigiCert High Assurance EV  → Baltimore CyberTrust  2025 May Entrust G2, EC1  → Entrust  2024 Sep Entrust L1K  → Entrust.net (2048)  → Entrust.net  2019 Mar GlobalSign R2, R3  → GlobalSign (R1)  2028 Jan SERCOM 2  → SERCOM  → ValiCert Class 1  2019 Jun Go Daddy G2  → Go Daddy Class 2  → ValiCert Class 2  2019 Jun Starfield G2  → Starfield Class 2  → ValiCert Class 2  2019 Jun RSA Security 2048 v3  ⇸ RSA Security 1024 v1  → ValiCert Class 3  -  IdenTrust Commercial 1  → DST X3  2021 Sep T-TeleSec GlobalRoot Class 2  → Deutsche Telekom 2  2019 Jul T-TeleSec GlobalRoot Class 3  → Deutsche Telekom 2  2018 Oct Another view: SSL-Tools. Do not expect help from CAs, because they do not like cross certs but their own root as anchor. I buy just such certificates which chain to an anchor in the third row. For DV, I go for RapidSSL Standard, which resolves to DigiCert Global and CyberTrust. For EV, I add ECDSA via Comodo which resolves to AddTrust External.