What Is a Dual-Use Certificate, and How to Know if Chrome Will Reject My Certificate on March 15, 2027
A dual-use certificate lists both server authentication and client authentication as allowed uses. Chrome's root program will reject one issued on or after March 15, 2027, though certificates issued before that date keep working. You can check your own certificate's Extended Key Usage field with one openssl command. Sectigo disclosed that over 118 million certificates carry both settings due to ambiguous certificate practice statement wording, and isn't revoking them, but that dispute doesn't change Chrome's cutoff. TLS Radar checks for this on every scan, free or full.
A dual-use certificate is one that lists both server authentication and client authentication as allowed uses in the same certificate. Chrome's root program will reject a certificate like this once it's issued on or after March 15, 2027. Nothing is broken about the certificate today - it works exactly as it should - but Chrome only allows a certificate to declare one job, not two, and yours currently declares both.
What server authentication and client authentication actually mean
| Extended Key Usage | What it proves | Typical use |
|---|---|---|
| serverAuth | Your website's identity, to a visitor's browser | Ordinary HTTPS on the public web |
| clientAuth | A device or service's identity, to something else | VPNs, internal APIs, service-to-service authentication |
They're different jobs for different audiences. Chrome's root program treats a certificate built for both as a security risk rather than a convenience, because a certificate meant to prove a server's identity to the public shouldn't also be usable to authenticate as a client somewhere else.
How to check your own certificate
Run openssl x509 -in yourcert.pem -noout -text and look for "X509v3 Extended Key Usage" in the output. If that section lists "TLS Web Server Authentication" and "TLS Web Client Authentication" together, that's a dual-use certificate. TLS Radar checks the same field automatically on every scan, free or full, and tells you plainly whether yours qualifies.
Why over 118 million certificates have this today
Sectigo disclosed that certificate practice statement wording open to more than one reading led to over 118,251,207 certificates carrying both settings, issued between September 2026 and April 2027 (Mozilla Bugzilla 2069640). Sectigo isn't revoking them. It argues the wording was ambiguous rather than a real error, that mass revocation would cause more harm to relying parties than the underlying issue, and that the ecosystem isn't ready for it anyway: Automated Renewal Information, the mechanism meant to make bulk reissuance manageable, sits at only 5.4% adoption among Sectigo's own certificates.
That argument doesn't change what Chrome does next. A dual-use certificate reissued on or after March 15, 2027 gets rejected regardless of how the wording dispute is resolved. The dispute is about whether these certificates were misissued under today's rules. Chrome's cutoff is a separate, forward-looking policy that doesn't depend on that answer.
What to do about it
If your certificate was issued before the cutoff, it keeps working today - this isn't an emergency. The only action that matters is at your next renewal: ask your CA to reissue with server authentication only, not both. If your renewal falls on or after March 15, 2027 and nothing changes, Chrome will reject the connection outright rather than warn you in advance.
What TLS Radar checks
TLS Radar flags a dual-use certificate issued before the cutoff as a warning, telling you to fix it at renewal. One issued on or after March 15, 2027 is flagged as high severity, because Chrome will actively reject it. Either way, you find out from a scan, not from a support ticket after the cutoff has already passed.
Check if your certificate is dual-use
See whether your certificate lists both server and client authentication - along with everything else our scanner checks. Free, no account required.
If you don't want to deal with PKI technicalities like dual-use certificates, we've got you
Among many other things, TLS Radar checks every certificate for dual use as well, so you can ask your vendor for a valid reissue well before March 2027, and stop worrying about whether Chrome will suddenly stop opening your website.
Related reading
Frequently asked questions
- What is a dual-use certificate?
- It's a certificate that lists both server authentication and client authentication as allowed uses - proving a website's identity to a browser, and also proving a device or service's identity to something else, like a VPN or an internal system.
- How do I know if Chrome will reject my certificate?
- Check whether your certificate's Extended Key Usage field lists both serverAuth and clientAuth. If it does, and the certificate is reissued on or after March 15, 2027, Chrome will reject it. Certificates issued before that date keep working.
- How do I check this myself?
- Run openssl x509 -in yourcert.pem -noout -text and look at the X509v3 Extended Key Usage section. If it lists both 'TLS Web Server Authentication' and 'TLS Web Client Authentication', it's a dual-use certificate.
- Why do so many certificates have this?
- Sectigo disclosed that its certificate practice statement wording was open to more than one reading, which led to over 118 million certificates carrying both settings. Sectigo isn't revoking them, arguing the wording was ambiguous rather than a genuine error.
- Does TLS Radar check for this?
- Yes, on every scan, free or full. A dual-use certificate issued before the cutoff is a warning; one issued on or after March 15, 2027 is high severity.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.