NET::ERR_CERT_AUTHORITY_INVALID for some visitors — new Let's Encrypt root not yet trusted - Help

Project: camera-shop-3d (team: shijaszaks-projects) Domain: snapcam.in Some visitors to our production domain are getting NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private) in Chrome on Android, confirmed via a screenshot from an affected user connecting directly to snapcam.in (not a redirect or proxy). We checked the served certificate chain:

Leaf: *.snapcam.in, issued by Let's Encrypt intermediate YR2
Intermediate YR2 issued by root Root YR
Root YR is cross-signed by ISRG Root X1, but Root YR itself was only issued in May 2026 (notBefore=May 13 00:00:00 2026 GMT) This is a very recently issued root, and we believe older or less-updated Android devices do not yet have it in their trust store, causing the certificate validation failure for a subset of visitors, while modern or updated devices connect fine. Since certificate issuance is auto-managed by Vercel, we cannot choose the CA ourselves. Could you help us either (a) force reissuance through a more widely-trusted existing root or intermediate, or (b) advise if there is a way to avoid the Root YR chain for this domain?

Leaf: *.snapcam.in, issued by Let's Encrypt intermediate YR2
Intermediate YR2 issued by root Root YR
Root YR is cross-signed by ISRG Root X1, but Root YR itself was only issued in May 2026 (notBefore=May 13 00:00:00 2026 GMT) This is a very recently issued root, and we believe older or less-updated Android devices do not yet have it in their trust store, causing the certificate validation failure for a subset of visitors, while modern or updated devices connect fine. Since certificate issuance is auto-managed by Vercel, we cannot choose the CA ourselves. Could you help us either (a) force reissuance through a more widely-trusted existing root or intermediate, or (b) advise if there is a way to avoid the Root YR chain for this domain?