Client Authentication Certificates (clientAuth) Deprecation

[ashaju2]

Phase 1: Starting the week of Nov 10, 2025, CSRs asserting the id-kp-clientAuth EKU will be rejected,
with the exception that:
1). the id-kp-serverAuth and id-kp-clientAuth EKUs must be set in the CSR, and
2). the clientAuth query parameter must be set in the directory URL.

Please see the FAQ for more details.

Phase 2: Starting the week of Apr 13, 2026, CSRs asserting the id-kp-clientAuth EKU will be rejected,
with no exceptions.

Issue:

• Can't issue new certificate or renew existing certificate

Expected Behavior:

• Ability to issue server authentication certificate and renew using Google Trust Services

[JohnLBevan]

Please see related issue: #916

[ashaju2]

Thank you @JohnLBevan