I have recently figured out that `Lets Encrypt` provides "invalid" certificate chain in it's certificates that are pointing to the root certificate that has expired a month ago (they did it apparently to support old android devices that do not fully validate the root certificate validity).

Certificates obviously work for most of the use cases though because there is a newer CA root certificate that OS/browsers do trust. That means that we can see 2 certification paths like on this image:

[![enter image description here](https://i.stack.imgur.com/DwWTh.png)](https://i.stack.imgur.com/DwWTh.png)

What I am wondering is what is the algorithm/protocol to figure out if one can trust such certificates where one path is trusted, while the other one is not (there probably can be multiple ones as well). Is it enough that at least one is trusted, or maybe the shortest?