2 ms·
It's a Chrome policy: https://googlechrome.github.io/chromerootprogram/ https://googlechrome.github.io/chromerootprogram/ 3.2.1 (item 2). In case it helps - am
by nickf 1y ago
It's a Chrome policy: https://googlechrome.github.io/chromerootprogram/ https://googlechrome.github.io/chromerootprogram/
3.2.1 (item 2).
In case it helps - am the CTO of a large CA, so (un)fortunately aware of what's happening and when.
- kbolino 1y agoWow, I completely missed bullet 2. It's quite clear: All corresponding unexpired and unrevoked subscriber (i.e., TLS server authentication) certificates issued on or after June 15, 2026 MUST include the extendedKeyUsage extension and only assert an extendedKeyUsage purpose of id-kp-serverAuth. Thanks!