Connection is not private on Android Chrome

[schoen]

@mongkey

If we modify the chain to ISRG Root X1 > DST Root CA 3 (expiring),
it will still not work after Sep 2021?

The community forum post at Production Chain Changes explains in more detail that

After September 29, 2021

Our default chain and alternate chain will not change, but DST Root CA X3 will expire. Android devices as far back as 2.3.6 will continue to work. Non-Android devices that aren't getting system updates will show certificate errors. On some platforms, using Firefox will be a workaround, since Firefox gets updates even on many out-of-date OSes.

This has to do with the specific behavior of Android in not enforcing validity dates for root certificates, unlike those for other kinds of certificates, which are enforced. As the article you linked to explains

This solution works because Android intentionally does not enforce the expiration dates of certificates used as trust anchors.

(Certificates used as trust anchors is, in this context, another way of referring to root certificates.)

There is no way to guarantee that the other chain will work for every device or every client after September 30, but it should still work for most Android clients for the reasons described in these articles.