--- title: "Web PKI Ditches TLS Client Authentication" url: https://daily.dev/posts/web-pki-ditches-tls-client-authentication-o830n7oou source_url: https://www.feistyduck.com/newsletter/issue_130_web_pki_ditches_tls_client_authentication type: article source: "Feisty Duck" published: 2025-10-30T08:42:21.985Z updated: 2026-03-30T02:17:53.319Z tags: ["google-chrome", "pki", "security"] reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Web PKI Ditches TLS Client Authentication **[Feisty Duck](https://daily.dev/sources/feistyduck)** · 6 min read · 0 upvotes · 0 comments ## Summary Chrome's root store policy now requires dedicated CA hierarchies exclusively for TLS server authentication, ending support for client authentication, S/MIME, and code signing by June 2026. Major CAs like DigiCert and Sectigo have already stopped issuing multipurpose certificates. While this strengthens Web PKI security by preventing cross-purpose certificate misuse, it creates challenges for mTLS use cases and threatens Certificate Transparency coverage as new Internet PKI hierarchies emerge without CT requirements. The change highlights the need for a comprehensive public root program that can enforce CT and security standards across all PKI use cases beyond just browser traffic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Changes to TLS clientAuth Certificates: Ensuring You’re Not Impacted](https://daily.dev/posts/changes-to-tls-clientauth-certificates-ensuring-you-re-not-impacted-ebetmr0aj) · Cisco · 0 upvotes · 0 comments - [Sectigo New Public Roots and Issuing CAs Hierarchy \[2025 Migration Guide\]](https://daily.dev/posts/sectigo-new-public-roots-and-issuing-cas-hierarchy-2025-migration-guide--psrux8jzm) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#google-chrome](https://daily.dev/tags/google-chrome), [#pki](https://daily.dev/tags/pki), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/web-pki-ditches-tls-client-authentication-o830n7oou)