Do *NOT* remove TLS Client Auth EKU!

[petercooperjr]

@mirabilos

many softwares have only a configuration option for the server
to set “the” certificate, which is then used both when initiating
TLS connections and when being called via a TLS connection

This claim surprises me, and does not match my experience.

• Postfix uses smtp_tls_cert_file for the client certificate to use for outbound connections, and smtpd_tls_cert_file for the server certificate.
• Exim similarly configures the smtp client transport certificate separately from the server certificate.
• Apache httpd configures client certificate for use in a reverse proxy to another server via SSLProxyMachineCertificateFile, though its server certificate is configured in SSLCertificateFile
• Nginx similarly uses a separate configuration property proxy_ssl_certificate for how to authenticate using a client certificate as a reverse proxy, not the normal server certificate settings.

I'm sure there's some software out there that will use the server certificate by default when acting as a client, but I'd expect that most of the time it'd be possible to configure it otherwise.