FAQs

FAQsHow do I

What Are the Key Features of EKU Advisor for TLS ClientAuth Migration?

Updated on December 3, 2025

EKU Advisor: Enterprise Tool for ClientAuth EKU Migration

Purpose

EKU Advisor is an enterprise-grade utility created to support organizations as they transition away from the use of the ClientAuth Extended Key Usage (EKU) in public TLS server certificates. With the impending deprecation of ClientAuth EKU by public Certificate Authorities (CAs), EKU Advisor enables teams to identify endpoints that may require client certificates. This proactive detection helps organizations develop a comprehensive migration plan towards private PKI infrastructure before changes are enforced by public CAs.

Key Features

Advanced TLS Renegotiation Detection: Detects scenarios where client certificates are required, including during TLS renegotiation and post-handshake authentication.

Path-Specific Analysis: Tests multiple URL paths per host, allowing for the detection of endpoint-specific authentication needs, such as for paths like /admin or /api/secure.

Multi-Vantage Analysis: Scans both from local and public DNS perspectives, highlighting differences between internal and external endpoint behaviour.

Comprehensive Detection: Utilizes analysis of TLS handshakes, HTTP response codes, and error patterns to determine whether client certificates are required.

Enterprise-Ready: Offers features like concurrent scanning, detailed reporting, and executive summaries, with three distinct output modes: Executive, Normal, and Verbose.

Platform Detection: Automatically identifies the hosting platform in use, such as Cloudflare, AWS, or Azure.

Flexible Output: Generates results in JSON, CSV, and human-readable console formats, with filtering options based on output mode.

Private CA Detection: Differentiates between certificates issued by public and private Certificate Authorities.

Usage Overview

Users are provided with platform-specific executables for Windows and Linux. These executables require no installation or pipeline setup, allowing immediate scanning of endpoints to identify client certificate requirements.

Basic Usage Examples

Single Host Scan

ekuadvisor.exe -hosts "api.example.com"

Multiple Hosts

ekuadvisor.exe -hosts "api.example.com,app.example.com:8443,secure.example.com"

Scan from File

ekuadvisor.exe -file hosts.txt

Enterprise-Scale Scan with CSV Export

ekuadvisor.exe -file enterprise-hosts.txt -csv results.csv -concurrency 50

Executive Summary Mode

ekuadvisor.exe -file hosts.txt -executive -json executive-report.json

Verbose Scan with Validation

ekuadvisor.exe -hosts "secure.example.com" -verbose -validate -roots custom-ca.pem

Multi-Path Testing

ekuadvisor.exe -hosts "api.example.com" -paths "/,/login,/admin,/secure"

Assessment Categories

EKU Advisor classifies endpoints based on the likelihood and enforcement of client certificate requirements:

[!] Likely Requires Client Certificate: Strong evidence of enforcement; migration planning is necessary.

[?] Possibly Supports Client Authentication: The certificate allows for client authentication, but enforcement cannot be confirmed.

[+] No Evidence of Client Certificate Enforcement: Endpoint appears safe for use with ServerAuth-only certificates.

[~] Unclear – Manual Review Recommended: Results are inconclusive; further manual testing is advised.

[O] Out of Scope – Private CA: Certificate issued by a private or internal CA; deprecation of public CA EKU does not apply.

Installation Guide

EKU Advisor is distributed as a ready-to-run executable for Windows, Linux, and macOS. No complex setup or build steps are required. Follow these steps:

Shape

Step 1: Download the Package

Obtain the EKU Advisor package for your operating system from the official distribution source or internal repository.

Ensure you select the correct version for your platform:

Windows: ekuadvisor.exe

Linux: ekuadvisor

Shape

Step 2: Extract the Package

Unzip or extract the downloaded archive to a directory of your choice.

Recommended: Use a directory with read/write permissions (e.g., C:\Tools\EKUAdvisor on Windows or /opt/ekuadvisor on Linux).

Shape

Step 3: Verify System Requirements

Network Access: Outbound HTTPS (port 443) must be allowed.

DNS Resolution: Tool may perform public DNS lookups for analysis.

No Credentials Needed: EKU Advisor does not require authentication credentials.

Shape

Step 4: Add to PATH (Optional)

For convenience, add the directory containing the executable to your system PATH:

Windows: setx PATH "%PATH%;C:\Tools\ekuadvisor"

Linux/macOS: export PATH=$PATH:/opt/ekuadvisor

Shape

Step 5: Run the Tool

Open a terminal or command prompt and execute the tool directly:

Windows Example:

ekuadvisor.exe -hosts "api.example.com"

Linux/macOS Example:

./ekuadvisor -hosts "api.example.com"

Shape

Quick Tips

Use -file hosts.txt for scanning multiple hosts.

Use -executive for business-friendly summaries.

Use -csv or -json for exporting results.

Output Formats

Console Summary: Presents actionable, human-readable recommendations.

JSON: Machine-readable format suitable for automation and dashboards, with three output modes tailored for different audiences.

CSV: Executive-friendly format, ideal for spreadsheet analysis.

Security & Limitations

Requires outbound HTTPS (port 443) connectivity.

May perform public DNS lookups to assess endpoint behaviour.

Analyses only public certificate information; does not access authentication credentials.

Detects client certificate requirements solely during the initial TLS handshake; does not assess mid-connection or application-level authentication triggers.

For further assistance, please contact Sectigo support