If so, that's by design in a way.

That's an indicator that your root level certs are not being maintained or updated. That risk is worse than just a few certificate authorities not being recognized.