Because of the note at the top of that post about Android devices not necessarily having the new root, I took out all of our Android devices to test them.
As expected, the site works on newer devices (e.g. Google Pixel, Samsung S8, S9, and S10), and does not work on some older ones (e.g. Google Nexus 5) where it gives a certificate error.
However, I have one device which I expected to show a certificate error but instead the site loaded properly!
On a Samsung S6 (Edge, Verizon), the site loads properly even though the ISRG X1 root is not in the trust store. When I check the certificate chain in the browser, I see that it is loading the Identrust
DST Root CA X3.
I thought the whole point of this test site is that it does not chain back to the Identrust root, so how is this phone loading it? Also, if this phone is loading it, why isn’t my Nexus 5?