You'll also need an explicit blacklist, since my understanding is that several CAs cross-sign to get support on older browsers.