It seems odd to me that the intermediates were cross signed instead of the having the root be cross signed.<p>With a cross signed root, clients with only the IdenTrust root will validate the cert, and clients with only the LetsEncrypt root can validate the cert.<p>With a cross signed intermediate, the server has to guess which root the client has and serve the correct path, there's a TLS extension to indicate roots the client supports, but nothing actually uses it, so I don't know how the server is going to guess (other than to assume no one has the LetsEncrypt root, since it's new).<p>[1] but some clients are dumb and won't validate successfully when they reach a root they know :/ Most browsers will though.