Public TLS certificates drop client authentication: What breaks for mTLS

Public certificate authorities are phasing out the client authentication Extended Key Usage (clientAuth EKU) from publicly trusted TLS certificates in response to Chrome Root Program requirements that subscriber certificates issued after March 15, 2027 support server authentication only. Let’s Encrypt has already removed the capability, while Sectigo and DigiCert will end all clientAuth issuance on February 10 and March 1, 2027, respectively, with limited regulatory exceptions varying by provider. Existing certificates containing clientAuth remain valid until expiration, but automated renewals may silently replace them with serverAuth-only certificates, causing mutual TLS client authentication failures in systems that enforce EKU purpose checks. Organizations should inventory certificates and mTLS integrations, especially partner connections, OAuth mTLS authentication, and internal services that reuse public HTTPS certificates, then migrate client identity to private PKI, X9 PKI, non-browser public roots, or token-based mechanisms where appropriate. Chrome’s policy does not prohibit client certificates generally or apply to private enterprise CAs; it narrows the browser web PKI to server authentication, making early discovery and migration essential before renewal-driven outages occur.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.