'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Impact of Sectigo Mutual TLS Certificate Changes on Exchange Hybrid
Question details
The user needs to understand the potential impact on Exchange Online hybrid deployments when Sectigo removes the Client Authentication EKU from its mutual TLS certificates, and whether other Certificate Authorities will follow suit.
- Product
- Microsoft Exchange
- Device & OS
- not provided
- Scenario
- Evaluating infrastructure impact due to upcoming certificate authority policy changes in a hybrid environment.
- Observed behavior
- Seeking technical clarification on what specific services might break and how to prepare for the EKU removal.
Before reaching out for support, gather your current Exchange Server build numbers, your exact Sectigo certificate properties, and the configuration details of your hybrid mail flow connectors.
Consult Microsoft Exchange Hybrid Specialists via Microsoft Learn
Because EKU changes involve complex enterprise infrastructure and mail routing, the most reliable way to assess the impact is to consult directly with Exchange Hybrid specialists.
Certificate requirements for Exchange Hybrid environments are strict. The removal of the Client Authentication EKU can potentially disrupt mutual TLS (mTLS) authentication between on-premises Exchange servers and Exchange Online.
Microsoft's dedicated engineers and community MVPs on the Microsoft Learn platform are best equipped to analyze your specific deployment and advise on compliant certificate alternatives.
Open your web browser and go to the official Microsoft Learn Q&A platform.
Use the search or tag filtering system to find the 'Exchange Hybrid Management' specific forum, ensuring your question reaches the right experts.
Create a new thread detailing your current Sectigo certificate, your hybrid setup, and your specific concerns regarding the Client Authentication EKU removal.
Manage Your IT Infrastructure Documentation with WPS Office
While resolving complex Exchange Server issues requires specialized Microsoft channels, you still need reliable software to document your hybrid deployment plans, draft migration scripts, and analyze server logs. WPS Office offers a powerful, lightweight alternative to Microsoft Office for IT professionals.
- 1. Download the Installer: Visit the official WPS Office website and click on 'Download WPS Office Free'.
- 2. Install the Suite: Run the lightweight setup file and follow the on-screen instructions to complete the installation in minutes.
- 3. Manage IT Documents: Open your CSV log files, deployment spreadsheets, or server documentation seamlessly within the unified workspace.
Frequently Asked Questions
What is the Client Authentication EKU in a TLS certificate?
EKU stands for Extended Key Usage. The Client Authentication EKU is a specific attribute that dictates the certificate can be used by a client to prove its identity to a server during a mutual TLS (mTLS) handshake.
Why would removing the Client Authentication EKU break Exchange Hybrid?
Exchange Hybrid heavily relies on mutual TLS to secure mail flow and synchronize data between on-premises servers and Microsoft 365. If the certificate used for the hybrid connector lacks the required authentication properties, the connection may be rejected, halting mail flow.
Are other Certificate Authorities planning to remove this EKU?
Changes to EKU policies are often driven by industry-wide security standards, such as those set by the CA/Browser Forum. It is highly likely that other major Certificate Authorities will implement similar restrictions over time.
How can I check if my current Exchange certificate uses this EKU?
You can view your certificate details via the Exchange Admin Center or the local Windows Certificate Manager (certlm.msc). Double-click the certificate, navigate to the 'Details' tab, and look for 'Enhanced Key Usage' to see if 'Client Authentication' is listed.
