DigiCert and Sectigo remove clientAuth EKU from public TLS certificates

Public certificate authorities and Google Chrome are removing the client authentication Extended Key Usage from public TLS certificates by early 2027. This change means that renewals of certificates previously used for both server and client authentication will drop the client authentication capability, causing mutual TLS handshakes to fail in stacks that check certificate purpose. Organizations must inventory their systems, separate public and private PKI uses, or migrate to alternative authentication methods before their renewal cycles break existing integrations. Open article →