I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate.
According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL CA - G4".
Now, in turn, GeoTrust EV SSL CA - G4 is issued by "GeoTrust Primary Certification Authority".
This root CA seems to be missing from both many Windows 7 systems and android mobile devices. In such systems, the only two GeoTrust Root CAs installed are "GeoTrust Global CA" and "Equifax Secure Certificate Authority".
In this cases, the browser shows "this site is not secure" warning and you must manually add an exception to continue browsing. I understand this is like that because there is no valid root CA to validate de certificate.
In order to solve this (ie. support for systems that do not have "GeoTrust Primary Certification Authority" among their available CAs), GeoTrust website says the following:
If you need to support legacy browsers, operating systems, customized applications and devices that do not have the GeoTrust Primary Certification Authority, install the cross-certificate along with the intermediate ca above. Click here
When you follow that link, you go to the cross-root certificate download page, that crosses "GeoTrust Primary Certification Authority" with "Equifax Secure Certificate Authority", which seems to be the most legacy (and thus widely supported) root CA.
So far, so good. But, there is a caveat. This cross-root certificate only comes in a SHA-1 flavor. So now, in newer systems, the browser shows a warning because there are insecure (SHA-1) certificates as part of the chain.
Does this mean this is an inevitable trade-off? Do I have to chose between leaving out the legacy users who don't have the newer root CA in their trusted store and the newer users with systems that only accept full SHA-256 chains?
Is this more a commercial than technical problem? (Should I buy another, perhaps more expensive - and compatible - certificate?). Am I greatly misunderstanding something here?