Yes -- but on older linux distributions curl, etc continue to try to use it

Interesting, I would've expected them to ignore an expired cert in the chain if there is also a still valid one.