As of June 15, Google Chrome no longer trusts newly issued public TLS certificates that include the client authentication (clientAuth) Extended Key Usage alongside server authentication. This enforces Chrome Root Program Policy v1.6, which requires certificate hierarchies in Chrome's trust store to be dedicated solely to server authentication going forward.
What actually gets rejected
Certificates issued before the cutoff date keep working until they naturally expire — this isn't retroactive. The restriction applies specifically to newly issued certificates carrying both EKUs at once. A certificate with only serverAuth is entirely unaffected; this is squarely about the mixed-purpose case.
The practical impact, for most sites: none
If you've only ever used your certificate for standard HTTPS — the overwhelming majority of this site's readers — this change has no visible effect at all. It specifically targets organizations using a single public certificate for both server identity and client authentication in some mutual TLS configuration, the same narrow use case affected by Let's Encrypt's own EKU change earlier this year.
If you are affected
The recommended path is splitting into two certificates: a standard public one for server authentication, and a separate client authentication certificate issued from a private CA rather than a public one. Google's own guidance frames this explicitly — mTLS client authentication scenarios are increasingly expected to run on private PKI, not the public certificate ecosystem, a theme that's come up repeatedly in this year's policy changes.
A pattern worth naming directly
Between Let's Encrypt's own EKU change, HARICA's compliance incident over this exact same requirement (covered separately), and now Chrome's enforcement landing, the industry's move away from dual-purpose public certificates has been one of the more consistent threads running through this year's certificate news.
This is our own summary and analysis of publicly reported news, written independently — not a reproduction of any single source's article. Where we reference a specific announcement, we link to it or name the organization directly.