For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

The End of ClientAuth EKU…Oh Mercy…What to do?

If you’ve spent any time recently monitoring the cryptography and/or Public Key Infrastructure (PKI) spaces…beyond that ever-present “Post Quantum” thing, you may have read that starting in May of 20...
Published Dec 04, 2025
Version 1.0
certficate
EKU
pki
security
ssl
tls
pietrucha92's avatar
pietrucha92
Icon for Altocumulus rankAltocumulus
Dec 20, 2025

I believe that BIG-IP DNS and iQuery may be impacted for many users.
Based on article: https://my.f5.com/manage/s/article/K7717 
The device certificate used for iQuery requires the ClientAuth EKU.
Therefore, please be aware that after the next renewal of a certificate signed by a public (third-party) PKI, the entire solution may stop working if this requirement is not met.