Hi there, I recently noticed that you've introduced new profile selection (detailed here: Announcing Certificate Profile Selection - Let's Encrypt ) as part of moving towards requiring "single-purpose" issuance hierarchies. It seems that more significant changes have also been made to Pebble ( see PR…

As far as I know, the "classic" profile remains the same. That said, it might not be up to Let's Encrypt, as according to the blog post: root programs are moving towards requiring “single-purpose” issuance hierarchies , where every certificate has only a single EKU And Let's Encrypt needs to abi…

We are currently working on finalizing plans an announcements, which should be up in March. But we will be announcing an approximately 1-year deprecation notice for the client authentication EKU to be compliant with Chrome’s June 2026 deadline. If your application relies on the client authenticati…

Also wouldn't shock me if other CAs eventually offered both client and server certificates, just as separate certificates from separate roots. It's still pretty early; Let's Encrypt is more up front about their future plans than most other CAs seem to be.

I just want to clarify something from @mcpherrinm 's post above: Chrome has set a deadline of June 2026 for compliance with their policy. Expect ALL publicly trusted CAs to follow suit. You will either have to migrate your application to comply with this change by that date OR you will have to mig…

[image] petercooperjr: Also wouldn't shock me if other CAs eventually offered both client and server certificates, just as separate certificates from separate roots. It's possible, but I would think free CAs won't do that. Why would they? Client authentication is best done with a private CA, …

Please see details in [image] Chrome Root Program v1.6 and Client Certificates Issuance Policy C…

Ah, thanks, somehow didn't remember that thread :slight_smile:

Thank you all. Now we know time frame we are working in. [image] mcpherrinm: We are currently working on finalizing plans an announcements, which should be up in March. Awaiting official statement from Let's Encrypt.

Certificates with single EKU

Issuance Policy

mcpherrinm February 24, 2025, 5:52pm 7

Please see details in

Topic		Replies	Views
Do NOT remove TLS Client Auth EKU! Feature Requests	126	7518	July 11, 2025
Ending TLS Client Authentication Certificate Support in 2026 API Announcements	5	2600	February 11, 2026
EKU of Root Certificate ISRG/Organizational	32	5577	July 19, 2022
Chrome Root Program v1.6 and Client Certificates Issuance Policy	1	574	March 16, 2025
Sunsetting of Client EKU Help	16	764	April 17, 2026

Certificates with single EKU

Related topics