Letsencrypt is ending Extended Key Usage (EKU) certificates for TLS Client Authentication for client side authentication in 2026.

Summary

Letsencrypt, an online certificate authority, has announced on their website that they plan to "no longer include the “TLS Client Authentication” Extended Key Usage (EKU) in our certificates beginning in 2026".
This will effect email servers using these certificates to authenticate email users using said email servers.

Chrome Root Store policy change.

Beginning in 2026.

Any services using Letsencrypt certificates.

Sources

• https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/
• https://news.ycombinator.com/item?id=44003349
• https://social.wildeboer.net/@jwildeboer/114516238307785904

1. https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/ ↩︎