--- title: The Public CA clientAuth EKU Sunset: What Apache... description: Starting May 2026, major public Certificate Authorities (CAs) including Let's Encrypt, DigiCert, Sectigo, and GlobalSign will stop including the Client... canonical: https://daily.dev/posts/the-public-ca-clientauth-eku-sunset-what-apache-software-deployers-need-to-know-nr5vrbigq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Public CA clientAuth EKU Sunset: What Apache Software Deployers Need to Know | daily.dev og:description: Starting May 2026, major public Certificate Authorities (CAs) including Let's Encrypt, DigiCert, Sectigo, and GlobalSign will stop including the Client... og:url: https://daily.dev/posts/the-public-ca-clientauth-eku-sunset-what-apache-software-deployers-need-to-know-nr5vrbigq og:image: https://api.daily.dev/og/posts/nr5vRBiGQ.png og:image:alt: The Public CA clientAuth EKU Sunset: What Apache Software Deployers Need to Know og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Public CA clientAuth EKU Sunset: What Apache Software Deployers Need to Know **[The Apache Software Foundation Blog](https://daily.dev/sources/apache)** · 9 min read · 0 upvotes · 0 comments ## Summary Starting May 2026, major public Certificate Authorities (CAs) including Let's Encrypt, DigiCert, Sectigo, and GlobalSign will stop including the Client Authentication Extended Key Usage (EKU) in publicly issued TLS certificates. This affects any deployment using mutual TLS (mTLS) with public-CA-issued client certificates — including Apache Kafka, Cassandra, ZooKeeper, Pulsar, Ignite, and Geode. Failures won't appear immediately but will surface silently during routine certificate renewals, potentially causing cascading authentication failures in distributed systems. Three migration paths are outlined: switching to an internal/enterprise CA for all certificates, using a hybrid model (public CA for servers, private CA for clients), or moving to server-only TLS with application-layer authentication. Deployers should immediately audit their environments, identify affected certificates using OpenSSL or keytool commands, and begin migration planning before the deadline. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Action Required: Potential Disruption of KurrentDB Service due to Public CA Certificate clientAuth EKU Removal](https://daily.dev/posts/action-required-potential-disruption-of-kurrentdb-service-due-to-public-ca-certificate-clientauth-e-jzapqod4d) · Event Store · 0 upvotes · 0 comments - [Changes to TLS clientAuth Certificates: Ensuring You’re Not Impacted](https://daily.dev/posts/changes-to-tls-clientauth-certificates-ensuring-you-re-not-impacted-ebetmr0aj) · Cisco · 0 upvotes · 0 comments - [Web PKI Ditches TLS Client Authentication](https://daily.dev/posts/web-pki-ditches-tls-client-authentication-o830n7oou) · Feisty Duck · 0 upvotes · 0 comments - [WebPKI and You](https://daily.dev/posts/webpki-and-you-auxufh8pa) · Lobsters · 0 upvotes · 0 comments - [Amazon EKS now supports certificate authority \(CA\) rotation with automated lifecycle management](https://daily.dev/posts/amazon-eks-now-supports-certificate-authority-ca-rotation-with-automated-lifecycle-management-anukhutjk) · AWS · 1 upvotes · 0 comments --- Tags: [#apache-kafka](https://daily.dev/tags/apache-kafka) [View this post on daily.dev](https://daily.dev/posts/the-public-ca-clientauth-eku-sunset-what-apache-software-deployers-need-to-know-nr5vrbigq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Public CA clientAuth EKU Sunset: What Apache Software Deployers Need to Know","url":"https://daily.dev/posts/the-public-ca-clientauth-eku-sunset-what-apache-software-deployers-need-to-know-nr5vrbigq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-public-ca-clientauth-eku-sunset-what-apache-software-deployers-need-to-know-nr5vrbigq"},"datePublished":"2026-04-23T19:52:21.375Z","dateModified":"2026-04-23T19:52:44.835Z","description":"Starting May 2026, major public Certificate Authorities (CAs) including Let's Encrypt, DigiCert, Sectigo, and GlobalSign will stop including the Client...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a4f6f54e6f36696733b97de18844433?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a4f6f54e6f36696733b97de18844433?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Apache Software Foundation Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Apache Software Foundation Blog","logo":"https://media.daily.dev/image/upload/s--SQsDxMlv--/f_auto/v1721999281/logos/apache","url":"https://daily.dev/sources/apache"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-public-ca-clientauth-eku-sunset-what-apache-software-deployers-need-to-know-nr5vrbigq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"apache-kafka","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Apache Software Foundation Blog","item":"https://daily.dev/sources/apache"},{"@type":"ListItem","position":3,"name":"The Public CA clientAuth EKU Sunset: What Apache Software Deployers Need to Know"}]} ```