Mail server certificate check: does it still have clientAuth?

Public CAs have stopped putting TLS Client Authentication (clientAuth) into new server certificates. A mail server that presents its certificate as a TLS client certificate (certificate-based connectors, mutual TLS with partners) can fail when its last dual-purpose certificate expires. Check yours: EKU list, expiry and what the renewal changes.

Server name

Port 25 can't be tested from here; 587, 465, 993 or 443 on the same server usually present the same certificate.

or paste a certificate (PEM)

What happens and when

Dates, who is affected and the fixes: public certificates lose clientAuth: what it means for mail servers.

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.