Source note · Setting up certificates on Cisco Expressway

Under the Chrome Root Program policy, public CAs may assert only the Server Authentication EKU on TLS certificates, and Let's Encrypt stopped issuing combined-EKU certificates on 2026-02-11.

Checked 2026-09-30

Public Root CAs must assert Extended Key Usage (EKU) ONLY for Server Authentication

Vendor: Cisco
Product: Cisco Expressway
Subsystem: eku
Deployment: on-premises
Region: not restricted
Release range: all releases
Checked: 2026-09-30

Sources

Prepare Expressway for Client Authentication EKU Sunset in Public CA Certificates — Cisco Systems · tier 2 current vendor documentation · Background > Chrome Root Program policy and timeline

Cite this note

APA

WarmTransfer. (2026, September 30). Setting up certificates on Cisco Expressway: source note expressway-certificate-setup-eku-public-cas-server-only. WarmTransfer. https://warmtransfer.net/knowledge/claims/expressway-certificate-setup-eku-public-cas-server-only

BibTeX

@misc{warmtransfer-claim-expressway-certificate-setup-eku-public-cas-server-only,
  title  = {Setting up certificates on Cisco Expressway: source note expressway-certificate-setup-eku-public-cas-server-only},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/claims/expressway-certificate-setup-eku-public-cas-server-only},
  note   = {Source note expressway-certificate-setup-eku-public-cas-server-only, checked 2026-09-30}
}

Read in context