5 ms·

From https://letsencrypt.org/2025/05/14/ending-tls-client-authentication https://letsencrypt.org/2025/05/14/ending-tls-client-authent... "This change is prompt

From https://letsencrypt.org/2025/05/14/ending-tls-client-authentication https://letsencrypt.org/2025/05/14/ending-tls-client-authent... "This change is prompted by changes to Google Chrome’s root program requirements, which impose a June 2026 deadline to split TLS Client and Server Authentication into separate PKIs. Many uses of client authentication are better served by a private certificate authority, and so Let’s Encrypt is discontinuing support for TLS Client Authentication ahead of this deadline." TL;DR blame Google

bawolff 8mo ago
Google didn't force lets encrypt to totally get out of the client cert business, they just decided it wasn't worth the effort anymore.
- josephcsible 8mo ago
  > they just decided it wasn't worth the effort anymore That seems disingenuous. Doesn't being in the client cert business now require a lot of extra effort that it didn't before, due entirely to Google's new rule?
  - Avamander 8mo ago
    No, not really. Unless you consider basic accountability "extra effort".
    - account42 8mo ago
      Basic accountability doesn't pay for the infrastructure required for a separate root.
- everfrustrated 8mo ago
  Feel free to start your own non-profit to issue client certs signed by a public authority. As LE says, most users of client certs are doing mtls and so self-signed is fine.
  - account42 8mo ago
    "Most users" is a convenient excuse to ignore affected users.
- nickf 8mo ago
  Publicly-trusted client authentication does nothing. It's not a thing that should exist, or is needed.
  - ahmedtd 8mo ago
    I don't think this is true. It's something that could be useful, with some sort of ACME-like automated issuance, but should definitely be issued from a non-WebPKI certificate authority.
  - account42 8mo ago
    It does if the "client" in the TLS sense is really a public server in a federated network. Like for example in XMPP which you may have heard of.
    - direwolf20 8mo ago
      Then you specify your protocol to accept server certs from clients

bawolff 8mo ago

Google didn't force lets encrypt to totally get out of the client cert business, they just decided it wasn't worth the effort anymore.

josephcsible 8mo ago
> they just decided it wasn't worth the effort anymore That seems disingenuous. Doesn't being in the client cert business now require a lot of extra effort that it didn't before, due entirely to Google's new rule?
- Avamander 8mo ago
  No, not really. Unless you consider basic accountability "extra effort".
  - account42 8mo ago
    Basic accountability doesn't pay for the infrastructure required for a separate root.
everfrustrated 8mo ago
Feel free to start your own non-profit to issue client certs signed by a public authority. As LE says, most users of client certs are doing mtls and so self-signed is fine.
- account42 8mo ago
  "Most users" is a convenient excuse to ignore affected users.
nickf 8mo ago
Publicly-trusted client authentication does nothing. It's not a thing that should exist, or is needed.
- ahmedtd 8mo ago
  I don't think this is true. It's something that could be useful, with some sort of ACME-like automated issuance, but should definitely be issued from a non-WebPKI certificate authority.
- account42 8mo ago
  It does if the "client" in the TLS sense is really a public server in a federated network. Like for example in XMPP which you may have heard of.
  - direwolf20 8mo ago
    Then you specify your protocol to accept server certs from clients