2mo ago

Lets Encrypt Ending TLS Client Authentication Certificate Support in 2026

letsencrypt.org Ending TLS Client Authentication Certificate Support in 2026

Let’s Encrypt will no longer include the “TLS Client Authentication” Extended Key Usage (EKU) in our certificates beginning in 2026. Most users who use Let’s Encrypt to secure websites won’t be affected and won’t need to take any action. However, if you use Let&rs...

cross-posted from: https://lemmy.bestiver.se/post/390337

Comments

Technology @europe.pub

Lets Encrypt Ending TLS Client Authentication Certificate Support in 2026

letsencrypt.org /2025/05/14/ending-tls-client-authentication/

9 0

Hacker News @lemmy.bestiver.se

Lets Encrypt Ending TLS Client Authentication Certificate Support in 2026

letsencrypt.org /2025/05/14/ending-tls-client-authentication/

49 6

10 comments

This change is prompted by changes to Google Chrome’s root program requirements, which impose a June 2026 deadline to split TLS Client and Server Authentication into separate PKIs.
Im curious for Google's reasoning.
- This honestly is basic security in a number of ways. Separate PKI for every use-case is the standard. Eggs in on ebasket, yadablahwut.
  The actual change shouldn't take long for LE to actually do, it's the implication of the thing though. I'd love to see a different tool for enrolling TLS services, or at least a better flow than the existing one.
  
  This honestly is basic security in a number of ways. Separate PKI for every use-case is the standard.
  So what is the PKI for client certificate authentication?

I've read a lot of outcry about this wrt self-hosted mail servers.
Some say this is fatal, some say it has no effect. Both sides seem to have valid technical arguments. It would be nice to understand the effects better.

10 comments