EKU of Root Certificate

[Nummer378]

@petercooperjr

The report at https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT still only shows the ISRG Roots as being for Server Authentication, but maybe it's a cached copy that takes some time to update?

I have doubts that this is really always up to date (this might not even be machine generated, but maintained in some Excel file at Microsoft...). Anyway, the 'actual' source of truth (the authoritative root file hosted on Microsoft servers, here) contains the Client Auth EKU for both certificates (I used this to parse the trust store file).

@petercooperjr

I don't see ISRG Root X2 in my list, even after visiting https://valid-isrgrootx2.letsencrypt.org/ in Edge

I've written a likely explanation here: Microsoft Windows Root Certificate Lazy-Loading - #5 by Nummer378