Changes to mTLS certificates

Obtaining an Extended Validation (EV) certificate with the client authentication Extended Key Usage (clientAuth EKU) is becoming increasingly difficult. In some cases, obtaining such a certificate may no longer be possible.

We are developing a new solution for client authentication certificates. The new solution will allow you to request a certificate through the Rabobank Developer Portal. You will no longer need to purchase a certificate from an external certificate authority or set up your own private certificate authority.

What can you do in the meantime?

We currently support EV SSL certificates that do not contain the clientAuth EKU. Upload the certificate to the Rabobank Developer Portal before you use it for mutual TLS.

Be aware that your own infrastructure may prevent you from using a certificate without the clientAuth EKU for client authentication. Clients using Microsoft server environments have reported this to be an issue.

Most CAs have already stopped issuing certificates with clientAuth. DigiCert is currently the remaining option we currently know; clientAuth is no longer included by default, but it can still be requested explicitly.

When will the new solution be available?

We do not yet have a confirmed release date. Our current goal is to make the new certificate solution available towards the end of the first quarter in 2027.

We will update this page when more information becomes available.