Topic starter
24/06/2026 7:07 pm
TL;DR: Browsers led by Google are ending support for dual-EKU public TLS certificates, which will remove ClientAuth from browser-trusted roots and force organisations to redesign mTLS and other client-authentication patterns, according to DigiCert. The shift exposes how much enterprise trust infrastructure depended on certificates doing two jobs at once.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “What the End of Dual-EKU TLS Means for ClientAuth and mTLS”.
Key questions
Q: What breaks when dual-EKU TLS certificates are no longer trusted for client authentication?
A: Client-authentication patterns that depended on a single public certificate for both server and client roles will stop working cleanly in browser-trusted environments.
Q: When should organisations use private PKI instead of public certificates for client auth?
A: Private PKI is usually the better fit when client authentication is limited to internal systems, administrative access, or services that do not need browser trust.
Q: How should teams design mTLS when client certificates must work across the internet?
A: Treat internet-facing mTLS as a dedicated trust architecture, not an extension of internal certificate practice.
Practitioner guidance
- Separate server and client certificate inventories Classify every certificate by purpose, issuer, and relying-party scope so dual-EKU assumptions can be removed before browser trust changes take effect.
- Move internal client auth to private PKI Use an internal PKI for applications that never need browser-trusted roots, and set explicit issuance, revocation, and lifespan rules for those workloads.
- Re-map internet-facing mTLS dependencies Identify partners, external services, and applications that require client authentication across the internet and decide whether they need a dedicated public PKI path.
Bottom line: Dual-EKU public TLS certificates are being phased out, which forces organisations to stop using one certificate for both server and client authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:15 am
Dual-EKU deprecation is an identity-purpose problem, not just a certificate-format change. The browser ecosystem is forcing organisations to stop treating one public certificate as a universal trust object. That matters because trust policy, not cryptography alone, defines what a certificate is allowed to authenticate. Practitioners should read this as a lifecycle and governance reset for client-authentication design.
A question worth separating out:
Q: Why do browser root programme changes matter for enterprise certificate governance?
A: Because browser trust programmes define what public certificates are allowed to represent. When those rules change, organisations must adjust inventory, issuance policy, and application dependencies instead of assuming certificate reuse will continue to work.
👉 Read our full editorial: Dual-EKU TLS deprecation is forcing clientauth certificate redesign