Oh, and to have a fuller collection of workarounds: * Date the certificate prior to 2019-07-01; this will work, as long as total validity < 825 days * Switch to a two-certificate hierarchy; a self-signed root and a locally-issued certificate. This is the most future-proof way, given Apple's movement in this space * Include the Netscape Cert Type](https://docs.oracle.com/cd/E19957-01/816-5533-10/ext.htm#1023061) extension 2.16.840.1.113730.1.1, which will [override](https://dxr.mozilla.org/mozilla-central/rev/b34beb21e1cf9d283ef0d855f68f63bcc15e40fb/security/nss/lib/certdb/certdb.c#497,508-513) the EKU
Bug 1590085 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Oh, and to have a fuller collection of workarounds: * Date the certificate prior to 2019-07-01; this will work, as long as total validity < 825 days * Switch to a two-certificate hierarchy; a self-signed root and a locally-issued certificate. This is the most future-proof way, given Apple's movement in this space * Include the [Netscape Cert Type](https://docs.oracle.com/cd/E19957-01/816-5533-10/ext.htm#1023061) extension 2.16.840.1.113730.1.1, which will [override](https://dxr.mozilla.org/mozilla-central/rev/b34beb21e1cf9d283ef0d855f68f63bcc15e40fb/security/nss/lib/certdb/certdb.c#497,508-513) the EKU