🔒 Public CA clientAuth EKU sunset — heads up for mTLS users TL;DR: Public CAs are removing clientAuth from TLS leaf certs (rolling out now through 2027). Pulsar deployments using public-CA-issued client certs for mTLS — most notably geo-replication brokers and external producers/consumers — will fail at the next cert renewal under the new policy. Server-only TLS is unaffected. Private PKI (OpenBao, step-ca, Vault, EJBCA, optionally fronted by cert-manager) is the path forward. Full write-up on users@ mailing list: https://lists.apache.org/thread/kbtnz7srvcsg0opj0vo15qm6rcx4btf8 ASF advisory: https://news.apache.org/foundation/entry/the-public-ca-clientauth-eku-sunset-what-apache-software-deployers-need-to-know