{"id":4474,"date":"2026-09-10T09:02:35","date_gmt":"2026-09-10T09:02:35","guid":{"rendered":"https:\/\/cheapsslweb.com\/blog\/?p=4474"},"modified":"2026-09-10T09:08:31","modified_gmt":"2026-09-10T09:08:31","slug":"what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes","status":"publish","type":"post","link":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/","title":{"rendered":"What is Extended Key Usage? How do Client Authentication EKU Changes Affect PKI?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><a><\/a>Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>EKU scope is narrowly defined for purposes beyond the Basic Key Usage.<\/li>\n\n\n\n<li>Public CAs proactively depreciate Client Authentication EKU in TLS certificates.<\/li>\n\n\n\n<li>Organizations have to distinguish between server and client certificates.<\/li>\n\n\n\n<li>Proper inventory and profiling avoid service interruption.<\/li>\n\n\n\n<li>Schedules from Sectigo and DigiCert require urgent action before the next renewal period.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">EKU is an essential X.509 certificate extension used to define what cryptographic purposes can be fulfilled with the public key of a certificate. <strong>Recent updates from the CA regarding the Client Authentication EKU redefine practices<\/strong> in the sphere of public key infrastructure. These changes necessitate adjustments to organisations&#8217; certificate policies.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Does Extended Key Usage Mean in Certificates?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Extended Key Usage is a kind of X.509 certificate extension that specifies particular purposes of the public key of a certificate. The difference between this extension and the Key Usage field consists in the fact that the latter includes only general uses such as digital signatures or key encryption.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>EKU limits the use of certificates to specific purposes<\/strong> such as server authentication, client authentication, code signing, email protection, etc. This field is checked by applications and systems before using the certificate. When the purpose is not found, the certificate is rejected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thus, separation of certificate uses prevents the reuse of one certificate for various purposes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Is the Structure of the EKU Certificate Extension?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The structure of the EKU extension is quite simple and is described by the ASN.1 syntax in accordance with <strong>RFC 5280<\/strong>. The object identifier of this extension is 2.5.29.37. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its value is presented in the form of a SEQUENCE of one or more KeyPurposeId objects, which are OBJECT IDENTIFIERS denoting an allowed purpose of use.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Common OIDs include:<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>1.3.6.1.5.5.7.3.1 (serverAuth)<\/li>\n\n\n\n<li>1.3.6.1.5.5.7.3.2 (clientAuth)<\/li>\n\n\n\n<li>1.3.6.1.5.5.7.3.3 (codeSigning)<\/li>\n\n\n\n<li>1.3.6.1.5.5.7.3 (emailProtection)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Is EKU Playing an Undercover Game in X.509 Certificates?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Key Usage only covers fundamental crypto functionalities, like signing and key encryption of keys. EKU provides a second, more stringent level of check, implemented by applications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In spite of a proper Key Usage value, an attempt to validate the certificate will fail if the required EKU is not present. A TLS server certificate lacking the serverAuth OID cannot be used for an HTTPS connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The same certificate cannot be used for authentication as a client in <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-mutual-tls-authentication-know-everything-about-mtls\/\">mTLS<\/a> without clientAuth<\/strong>. It cannot be used for <a href=\"https:\/\/cheapsslweb.com\/email-identity\/comodo-smime-certificate\">S\/MIME encryption<\/a> by email clients without emailProtection. Also, it cannot sign code without code signing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How is EKU Different from the Key Usage Extension?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Key Usage and Extended Key Usage collaborate, but have their own level of control. Key Usage controls the cryptographic usage of the key. EKU selects which practical purposes can employ that key.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Aspect<\/strong><\/td><td><strong>Key Usage<\/strong><\/td><td><strong>Extended Key Usage<\/strong><\/td><\/tr><tr><td>Purpose<\/td><td>Defines basic cryptographic operations<\/td><td>Defines high-level application purposes<\/td><\/tr><tr><td>Granularity<\/td><td>Coarse (digitalSignature, keyEncipherment, etc.)<\/td><td>Fine-grained (serverAuth, clientAuth, codeSigning, etc.)<\/td><\/tr><tr><td>Enforcement<\/td><td>Cryptographic engines<\/td><td>Applications and relying parties<\/td><\/tr><tr><td>Criticality<\/td><td>Cryptographic engines<\/td><td>Frequently marked critical for security<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Designers of certificates have to add both extensions; only one is not enough.<\/li>\n\n\n\n<li>Validators first check Key Usage for cryptographic capability, followed by EKU for application capability.<\/li>\n\n\n\n<li>Absence of a correct EKU will invalidate the certificate despite a seemingly flawless Key Usage extension.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What is Client Authentication EKU?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Client Authentication EKU has the object identifier <strong>1.3.6.1.5.5.7.3.2<\/strong>. The presence of that OID indicates that the certificate is used to verify the identity of the client to the server.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>If the certificate contains that extension<\/strong>, the holder can use it to authenticate itself as a TLS client. That requirement is enforced by the servers during the <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-mutual-tls-authentication-know-everything-about-mtls\/\">mutual TLS handshake process<\/a>. When verifying the certificate, the server checks the signature path along with the clientAuth EKU.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">The lack of this extension means that even an otherwise cryptographically valid certificate will not pass the client authentication procedure. Such certificates are simply ignored by the applications.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is the Difference Between Server Authentication And Client Authentication EKU?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Server Authentication and Client Authentication EKUs work on opposing ends of a TLS link. They differ in OIDs and directions of trust.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Server Authentication (1.3.6.1.5.5.7.3.1)&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use cases:<\/strong> Secure websites (HTTPS), APIs, load balancing services\u00a0<\/li>\n\n\n\n<li><strong>Trust direction:<\/strong> Clients authenticate the server\u2019s identity\u00a0<\/li>\n\n\n\n<li><strong>Validation:<\/strong> Browsers and other clients will not accept the certificate without the OID in their encrypted session<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Client Authentication (1.3.6.1.5.5.7.3.2)&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use cases:<\/strong> Mutual TLS, identifying services, establishing connections between devices or clients, VPN connections\u00a0<\/li>\n\n\n\n<li><strong>Trust direction:<\/strong> Server authenticates the client\u2019s identity\u00a0<\/li>\n\n\n\n<li><strong>Validation:<\/strong> This OID is needed by the servers in the process of a <a href=\"https:\/\/cheapsslweb.com\/blog\/ssl-tls-handshake-explained-process-work-and-importance\/\">TLS handshake<\/a>; otherwise, the connection won\u2019t start<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Even though a certificate can contain both of them at once, nowadays, public CAs separate these purposes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Is Client Authentication EKU Changing?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are several well-defined reasons why public certificate authorities are stripping the <a href=\"https:\/\/knowledge.digicert.com\/alerts\/sunsetting-client-authentication-eku-from-digicert-public-tls-certificates\">Client Authentication EKU out of TLS certificates<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, stronger baseline standards from the CA\/Browser Forum and Chrome Root Program mandate purpose separation. TLS certificates issued publicly may only have the serverAuth EKU.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, there is increased exposure through dual-purpose certificates. A certificate that does both <a href=\"https:\/\/cheapsslweb.com\/resources\/server-certificate-vs-client-certificate\/\">client and server authentication<\/a> introduces additional risk when compromised.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Third, current best practices in PKI suggest least privilege. Client authentication should occur in private\/enterprise PKIs where organisations manage issuance, validity, and revocation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Does the Deprecation of the Client Authentication EKU Mean?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The leading certificate authorities have stopped including the Client Authentication EKU in publicly available TLS certificates. CA\/B Forum and the Chrome Root Program mandate that publicly trusted server certificates should only have the serverAuth key usage purpose.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">As per the new policies, DigiCert, Sectigo, Let\u2019s Encrypt, among others, no longer include the clientAuth OID by default. Almost all certificate providers have disabled the possibility of issuing such certificates.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Dual-purpose certificates will continue working till their expiry, but any renewed or newly issued certificate will not include the clientAuth EKU.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This policy will force companies using public certificates for mutual TLS to migrate client authentication to private PKI infrastructure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Are the Effects of EKU Deprecation for Client Authentication?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The absence of Client Authentication EKU from public TLS certificates causes an immediate impact on business.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The most vulnerable to this change are mutual-TLS implementations. The certificates that used to have both serverAuth and clientAuth capabilities will function fine until they expire. When renewed, the new certificate no longer has the clientAuth capability, resulting in a <a href=\"https:\/\/cheapsslweb.com\/blog\/how-to-fix-ssl-tls-handshake-failed-error\/\">handshake failure<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Any system that utilizes a <a href=\"https:\/\/cheapsslweb.com\/buy-ssl-certificates\">public TLS certificate<\/a> as a client identity will go out of work upon the renewal period. Companies will find out about the issue by experiencing traffic failure if they do not prepare the inventory of dual-EKU applications ahead of time.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Are the EKU Deprecation Timelines for Sectigo and DigiCert?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Each of these organisations uses a two-phase process. Check your certificates against the following dates.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>DigiCert &nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>1 October 2025:<\/strong> Will stop using clientAuth by default\u00a0<\/li>\n\n\n\n<li><strong>1 March 2027:<\/strong> Will completely remove clientAuth from new certificates, reissuances, and renewals\u00a0<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Sectigo&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>14 October 2025:<\/strong> Will stop using clientAuth by default\u00a0<\/li>\n\n\n\n<li><strong>10 February 2027:<\/strong> Will completely remove clientAuth from all new SSL\/TLS certificates\u00a0<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Dual-EKU certificates stay valid until their expiration. Renewed certificates will no longer include the clientAuth purpose.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How can Organisations Plan for EKU Client Authentication Changes?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Organisations need to take steps well ahead of the next renewal cycle. <strong>Do the following to stay away from service outages:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>List down all certificates that have a clientAuth EKU right now. Employ tools like OpenSSL or even certificate management utilities to conduct inventories of your production and staging environments.<\/li>\n\n\n\n<li>Classify your server and client certificate profiles. Create individualised client certificates using your private Certificate Authority for all your mutual TLS and device identity use cases.<\/li>\n\n\n\n<li>Revamp <a href=\"https:\/\/cheapsslweb.com\/ssl-certificate-automation\">automation and ACME workflows<\/a>. Exclude requests that are still trying to acquire dual-EKU certificates from public CAs.<\/li>\n\n\n\n<li>Test your mutual TLS communication under the new conditions. Swap your dual-EKU certificates with those of just clientAuth in non-production environments to see if handshakes complete successfully.<\/li>\n\n\n\n<li>Contact <a href=\"https:\/\/cheapsslweb.com\/ssl-brands\">certificate authorities<\/a>. Make sure you know their exact cut-off date and learn about the solutions they offer for client authentication or even private PKI solutions.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Common FAQs<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is it possible for a certificate to still have serverAuth and clientAuth at once?<\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\"><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The issuance of dual-EKU certificates by public CAs has been discontinued. Current ones continue to have both until expiration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What about existing certificates after the deprecation date?<\/h3>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\"><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">They are going to be operational and valid until their expiration. They won\u2019t be revoked automatically.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Are there any restrictions on private CAs?<\/h3>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\"><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">No. Unlike public CAs, private\/enterprise CAs don\u2019t have to comply with the CA\/Browser Forum public-trust requirements.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How does the implementation happen via browser or OS vendors?<\/h3>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\"><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Chrome and other root programs will stop accepting new public certificates with clientAuth after the enforcement dates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Being aware of Extended Key Usage and responding to the deprecation will improve the position of every PKI-enabled company. These changes will lead to improved role separation, tighter purpose controls, and proper certificate lifecycle management practices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This new development should be considered an opportunity rather than a requirement. Identify dual-purposed certificates, move client authentication into internal PKI, and update your certificate profiles immediately.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Key Takeaways EKU is an essential X.509 certificate extension used to define what cryptographic purposes can be fulfilled with the public key of a certificate. Recent updates from the CA regarding the Client Authentication EKU redefine practices in the sphere of public key infrastructure. These changes necessitate adjustments to organisations&#8217; certificate policies. What Does Extended&hellip; <a class=\"more-link\" href=\"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/\">Continue reading <span class=\"screen-reader-text\">What is Extended Key Usage? How do Client Authentication EKU Changes Affect PKI?<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":4476,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[436],"tags":[442,440,441,443],"class_list":["post-4474","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-news-updates","tag-client-authentication-eku","tag-eku","tag-eku-removal","tag-extended-key-usage-eku","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Client Authentication EKU Changes: What They Mean for PKI &amp; TLS<\/title>\n<meta name=\"description\" content=\"Understand Client Authentication EKU changes, including the March 2027 removal, impact on mTLS and PKI, and alternative certificate options.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Client Authentication EKU Changes: What They Mean for PKI &amp; TLS\" \/>\n<meta property=\"og:description\" content=\"Understand Client Authentication EKU changes, including the March 2027 removal, impact on mTLS and PKI, and alternative certificate options.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/\" \/>\n<meta property=\"og:site_name\" content=\"CheapSSLWeb.com Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cheapsslweb\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-10T09:02:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-10T09:08:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"621\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Janki Mehta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif\" \/>\n<meta name=\"twitter:creator\" content=\"@cheapsslweb\" \/>\n<meta name=\"twitter:site\" content=\"@cheapsslweb\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Janki Mehta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/\"},\"author\":{\"name\":\"Janki Mehta\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/person\\\/d8997d6347486bdb48bdef47d50eb850\"},\"headline\":\"What is Extended Key Usage? How do Client Authentication EKU Changes Affect PKI?\",\"datePublished\":\"2026-09-10T09:02:35+00:00\",\"dateModified\":\"2026-09-10T09:08:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/\"},\"wordCount\":1516,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/extende-key-usage-eku.avif\",\"keywords\":[\"Client Authentication EKU\",\"EKU\",\"EKU removal\",\"Extended Key Usage (EKU)\"],\"articleSection\":[\"Industry News &amp; Updates\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/\",\"name\":\"Client Authentication EKU Changes: What They Mean for PKI & TLS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/extende-key-usage-eku.avif\",\"datePublished\":\"2026-09-10T09:02:35+00:00\",\"dateModified\":\"2026-09-10T09:08:31+00:00\",\"description\":\"Understand Client Authentication EKU changes, including the March 2027 removal, impact on mTLS and PKI, and alternative certificate options.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/extende-key-usage-eku.avif\",\"contentUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/extende-key-usage-eku.avif\",\"width\":960,\"height\":621,\"caption\":\"End of Client Authentication EKU in TLS Certificates\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Industry News &amp; Updates\",\"item\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/industry-news-updates\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"End of Client Authentication EKU in TLS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/\",\"name\":\"CheapSSLWeb.com Blog\",\"description\":\"Encryption and Web Security Blog\",\"publisher\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#organization\",\"name\":\"CheapSSLWeb\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/logo.png\",\"contentUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/logo.png\",\"width\":177,\"height\":60,\"caption\":\"CheapSSLWeb\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cheapsslweb\",\"https:\\\/\\\/x.com\\\/cheapsslweb\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cheapsslweb\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/cheapsslweb\\\/\",\"https:\\\/\\\/www.instagram.com\\\/cheapsslweb\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/person\\\/d8997d6347486bdb48bdef47d50eb850\",\"name\":\"Janki Mehta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"caption\":\"Janki Mehta\"},\"description\":\"Janki Mehta is a Cyber-Security Enthusiast who constantly updates herself with new advancements in the Web and Cyber Security niche. With having 7+ years of experience and knowledge about Encryption, Digital Certificates and Online Security, She helps online users to stay safe and protect their online presence.\",\"sameAs\":[\"https:\\\/\\\/cheapsslweb.com\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/pw-jankimehta\\\/\"],\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/author\\\/janki-mehta\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Client Authentication EKU Changes: What They Mean for PKI & TLS","description":"Understand Client Authentication EKU changes, including the March 2027 removal, impact on mTLS and PKI, and alternative certificate options.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/","og_locale":"en_US","og_type":"article","og_title":"Client Authentication EKU Changes: What They Mean for PKI & TLS","og_description":"Understand Client Authentication EKU changes, including the March 2027 removal, impact on mTLS and PKI, and alternative certificate options.","og_url":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/","og_site_name":"CheapSSLWeb.com Blog","article_publisher":"https:\/\/www.facebook.com\/cheapsslweb","article_published_time":"2026-09-10T09:02:35+00:00","article_modified_time":"2026-09-10T09:08:31+00:00","og_image":[{"width":960,"height":621,"url":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif","type":"image\/jpeg"}],"author":"Janki Mehta","twitter_card":"summary_large_image","twitter_image":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif","twitter_creator":"@cheapsslweb","twitter_site":"@cheapsslweb","twitter_misc":{"Written by":"Janki Mehta","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#article","isPartOf":{"@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/"},"author":{"name":"Janki Mehta","@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/person\/d8997d6347486bdb48bdef47d50eb850"},"headline":"What is Extended Key Usage? How do Client Authentication EKU Changes Affect PKI?","datePublished":"2026-09-10T09:02:35+00:00","dateModified":"2026-09-10T09:08:31+00:00","mainEntityOfPage":{"@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/"},"wordCount":1516,"commentCount":0,"publisher":{"@id":"https:\/\/cheapsslweb.com\/blog\/#organization"},"image":{"@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#primaryimage"},"thumbnailUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif","keywords":["Client Authentication EKU","EKU","EKU removal","Extended Key Usage (EKU)"],"articleSection":["Industry News &amp; Updates"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/","url":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/","name":"Client Authentication EKU Changes: What They Mean for PKI & TLS","isPartOf":{"@id":"https:\/\/cheapsslweb.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#primaryimage"},"image":{"@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#primaryimage"},"thumbnailUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif","datePublished":"2026-09-10T09:02:35+00:00","dateModified":"2026-09-10T09:08:31+00:00","description":"Understand Client Authentication EKU changes, including the March 2027 removal, impact on mTLS and PKI, and alternative certificate options.","breadcrumb":{"@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#primaryimage","url":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif","contentUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/extende-key-usage-eku.avif","width":960,"height":621,"caption":"End of Client Authentication EKU in TLS Certificates"},{"@type":"BreadcrumbList","@id":"https:\/\/cheapsslweb.com\/blog\/what-is-extended-key-usage-eku-in-pki-latest-clientauth-eku-changes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cheapsslweb.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Industry News &amp; Updates","item":"https:\/\/cheapsslweb.com\/blog\/industry-news-updates\/"},{"@type":"ListItem","position":3,"name":"End of Client Authentication EKU in TLS"}]},{"@type":"WebSite","@id":"https:\/\/cheapsslweb.com\/blog\/#website","url":"https:\/\/cheapsslweb.com\/blog\/","name":"CheapSSLWeb.com Blog","description":"Encryption and Web Security Blog","publisher":{"@id":"https:\/\/cheapsslweb.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cheapsslweb.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cheapsslweb.com\/blog\/#organization","name":"CheapSSLWeb","url":"https:\/\/cheapsslweb.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2022\/03\/logo.png","contentUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2022\/03\/logo.png","width":177,"height":60,"caption":"CheapSSLWeb"},"image":{"@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cheapsslweb","https:\/\/x.com\/cheapsslweb","https:\/\/www.linkedin.com\/company\/cheapsslweb\/","https:\/\/www.pinterest.com\/cheapsslweb\/","https:\/\/www.instagram.com\/cheapsslweb\/"]},{"@type":"Person","@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/person\/d8997d6347486bdb48bdef47d50eb850","name":"Janki Mehta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","caption":"Janki Mehta"},"description":"Janki Mehta is a Cyber-Security Enthusiast who constantly updates herself with new advancements in the Web and Cyber Security niche. With having 7+ years of experience and knowledge about Encryption, Digital Certificates and Online Security, She helps online users to stay safe and protect their online presence.","sameAs":["https:\/\/cheapsslweb.com\/","https:\/\/www.linkedin.com\/in\/pw-jankimehta\/"],"url":"https:\/\/cheapsslweb.com\/blog\/author\/janki-mehta\/"}]}},"_links":{"self":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts\/4474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/comments?post=4474"}],"version-history":[{"count":6,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts\/4474\/revisions"}],"predecessor-version":[{"id":4483,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts\/4474\/revisions\/4483"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/media\/4476"}],"wp:attachment":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/media?parent=4474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/categories?post=4474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/tags?post=4474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}