The way they got that old cross sign to keep working was quite interesting:
> The new cross-sign will be somewhat novel because it extends beyond the expiration of DST Root CA X3. This solution works because Android intentionally does not enforce the expiration dates of certificates used as trust anchors. [1]
Trust anchors work really differently than other certificates in practice, which can be surprising [2].
IIRC one of the bigger problems was that older versions of OpenSSL did check root anchor expiration. But that wasn't all - at my then-employer we had a brief outage on some of our systems because Ubuntu had to patch something (I don't recall what) to deal with this, and they only released the patch a few days before the expiration. We had to mass-rebuild all our Docker images to fix the issue.
This workaround was so wild and unprecedented that I assume the cost difference vs. getting cross-sig from an unexpired (and widely compatible) root was massive for them to use it. There must have been a huge amount of testing involved. The fact that it went as smoothly as it did (mostly, but not completely) was impressive.
I was a bit surprised that the Android way is not how it works everywhere. I had assumed that the time validation of a TLS certificate chain C0 -> C1 -> C2 ... -> Cn went something like this (in pseudocode):
1 time_check = now()
2 for cert in Cn to C0
3 if time_check < cert.valid_from || time_check > cert.valid_to
4 return EXPIRED
5 time_check = cert.issue_time
6 return NOT_EXPIRED
but a bit of Googling shows tells me that it works like that pseudocode with line #5 omitted so that all the time checks are against the current time. All certificates in the chain must be valid now.
With code signing certificates it does work the way I assumed TLS work. Timestamped code signed with an expired root certificate is still valid as long as the root certificate was valid at the time of the timestamp.
> The new cross-sign will be somewhat novel because it extends beyond the expiration of DST Root CA X3. This solution works because Android intentionally does not enforce the expiration dates of certificates used as trust anchors. [1]
Trust anchors work really differently than other certificates in practice, which can be surprising [2].
[1] https://letsencrypt.org/2020/12/21/extending-android-compati...
[2] https://alexsci.com/blog/name-non-constraint/