Do *NOT* remove TLS Client Auth EKU!

Google isn't paying Let's Encrypt to break anything. Google is setting requirements for all CAs, if they want to be trusted in Chrome, to split out server certificates from client certificates.

Now I'm not that familiar with XMPP, but I don't know why connections between XMPP systems would be harder to migrate to another CA than any other system. That "another CA" might be a private CA special-purpose created just for each pair of XMPP systems, or a private CA run by the XMPP community that's more widely trusted, or maybe a public CA (other than Let's Encrypt) that will be choosing to continue to offer a client-certificate hierarchy.

If you want to take the fight to Google, that you don't like forcing changes of having certificates used for public websites be different from certificates used for integration between backend systems, you're more than welcome to. But Google is trying to protect their users the best they can, and generally having single-purpose certificates and roots can help minimize attack surfaces. I don't know as any "community leaders" here are that thrilled with needing to make those kinds of changes, but I think we just recognize that engineering is sometimes (always?) about trying to make the best decisions possible while understanding tradeoffs.

And Let's Encrypt, as a nonprofit with only a few dozen employees, is focused first and foremost on securing https web servers. I'm sure they'd be happy to run a client certificate root if they had the funding and thought it was a core part of their mission. But they're not the only CA in town, and they're not even the only free CA in town.

6 Likes