Changes to public TLS certificates: what you need to know and how to prepare

The digital certificate ecosystem is constantly evolving, and it’s important for organizations to stay abreast of changes that impact the security and continuity of their operations.

On a temporary basis, until May 1, 2026, it will still be possible to manually select the client authentication option during the issuance process for public TLS/SSL certificates. However, after that date, this option will be permanently discontinued for new issuances, renewals, reissuances, and duplications.

What does this change entail?

The elimination of the client authentication EKU in public TLS certificates responds to the need to align market practices with browser standards and regulatory bodies. For organizations still using this type of authentication, it will be crucial to plan ahead for the transition to alternatives that guarantee security and interoperability.

Options available for your organization

At CertiSur, we support you in this adaptation process and offer various solutions:

• PKI X9 for TLS certificates
  Allows you to maintain the use of the client authentication EKU under an independent certificate policy and supported by a common root of trust. It provides control, flexibility, and scalability for complex environments.

• PKI as a Service
  An alternative designed for internal needs. We configure and manage a private PKI for your company, supported by our operational experience and top-level security standards.

• Trust Lifecycle Manager
  A discovery and automation tool that facilitates certificate lifecycle management, helping you identify changes, mitigate risks, and modernize your digital trust infrastructure.

How to follow

If your organization relies on the EKU for client authentication, now is the time to evaluate alternatives and design a secure migration strategy.

At CertiSur, we’re ready to advise you and help you implement the most appropriate solution for your situation.

Do you have questions or would you like to speak with a specialist?
Contact us at
sales@certisur.com
and let’s work together on the transition plan.