That's not allowed. > To qualify as a dedicated TLS server authentication PKI hierarchy under this policy: > All corresponding unexpired and unrevoked subordi

That's not allowed. > To qualify as a dedicated TLS server authentication PKI hierarchy under this policy: > All corresponding unexpired and unrevoked subordinate CA certificates operated beneath an applicant root CA MUST: > [...] > when disclosed to the CCADB… > [...] > on or after June 15, 2025, include the extendedKeyUsage extension and only assert an extendedKeyUsage purpose of id-kp-serverAuth. > [...] > NOT contain a public key corresponding to any other unexpired or unrevoked certificate that asserts different extendedKeyUsage values. https://googlechrome.github.io/chromerootprogram/policy-archive/policy-version-1-7/#421-applicant-pki-hierarchies https://googlechrome.github.io/chromerootprogram/policy-arch...