Repository navigation
Drop ClientAuth EKU #76
Description
In preparation for "Ending TLS Client Authentication Certificate Support in 2026"
https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/
ClientAuth EKU should be dropped.
I will submit a PR that fully drops ClientAuth. I thought about making ClientAuth optional, but then one would need to handle situations where a leaf cert with ClientAuth is requested from a Root Cert that does not have it.
Activity
wgreenberg commentedon Jul 24, 2025
FWIW, we've got an admittedly niche use case of relying on minica for generating certs for client auth. would folks be open to a PR which adds client auth as an option?
jvanasco commentedon Jul 24, 2025
@wgreenberg sorry :( I didn't generate that PR thinking of those possible needs.
wgreenberg commentedon Jul 24, 2025
all good! we can always use an older
minicafor now :)jsha commentedon Jul 25, 2025
Yep, older
minicashould be good for this use case! I'd prefer that over adding more options.