[DB-2037] Add EKUs phase 2: dual server certificates

docs/server/quick-start/whatsnew.md

@@ -4,6 +4,20 @@ order: 2
 
 # What's New
 
+## New in 26.1
+
+### Dual certificate support for cluster communication
+
+<Badge text="Experimental: Subject to change" type="warning" vertical="middle"/>
+
+KurrentDB now supports configuring a separate certificate for outbound connections to other cluster nodes. This allows using a publicly trusted certificate to authenticate the node as a server (so that client applications need not install a private CA root) while using a privately issued certificate to authenticate the node as a client to other nodes.
+
+This addresses the industry-wide removal of the `clientAuth` Extended Key Usage from public CA certificates, driven by changes to the Chrome Root Program policy. With dual certificates, clusters can use public CA server certificates without the `DisableClientAuthEkuValidation` workaround, while remaining compliant with RFC 5280.
+
+See [Protocol security](../security/protocol-security.md#node-client-certificate-file) for configuration details.
+
+This feature is experimental in the sense that the configuration options and behavior are subject to change according to feedback from the community.
+
 ## New in 26.0
 
 Features

docs/server/release-schedule/release-notes.md

@@ -4,16 +4,12 @@ order: 1
 
 # Release notes
 
-This page contains the release notes for KurrentDB v26.0.
+This page contains the release notes for KurrentDB v26.1.
 
-## [26.0.0](https://github.com/kurrent-io/KurrentDB/releases/tag/v26.0.0)
+## [26.0.1](https://github.com/kurrent-io/KurrentDB/releases/tag/v26.0.1)
 
-16 January 2026
+30 April 2026
 
 ### What's new
 
 Find out [what's new](../quick-start/whatsnew.md) in this release.
-
-### Projections: Fixed wake-up race condition (PR [#5428](https://github.com/kurrent-io/KurrentDB/pull/5428)) 
-
-When writing empty transactions (write requests with 0 events in) a race condition existed where a projection that had reached the end of its input stream and stopped might not detect the addition of a new event. The new event could remain unprocessed until another event is written to any stream. Subsequent new events written to any stream would allow the projection to continue and process any outstanding events correctly. Writing empty transactions is uncommon but supported by the database.

docs/server/security/protocol-security.md

@@ -194,6 +194,98 @@ If multiple matching root certificates are found, then the root certificate with
 | YAML                 | `TrustedRootCertificateSubjectName`                |
 | Environment variable | `KURRENTDB_TRUSTED_ROOT_CERTIFICATE_SUBJECT_NAME`  |
 
+### Node client certificate file
+
+<Badge text="Experimental: Subject to change" type="warning" vertical="middle"/>
+
+By default, a KurrentDB node uses the same certificate for both inbound connections (server authentication) and outbound connections to other nodes (client authentication). The node client certificate settings allow you to configure a separate certificate for outbound connections to other nodes.
+
+This is useful when you want to use a certificate from a public CA for inbound client connections (which may only have the `serverAuth` EKU), while using a certificate from a private CA with both the `serverAuth` and `clientAuth` EKUs for inter-node communication. Using dual certificates this way is an alternative to enabling [`DisableClientAuthEkuValidation`](#disable-client-authentication-eku-validation) and keeps the node in compliance with RFC 5280.
+
+If no node client certificate is configured, the node will use its main certificate as it's client certificate.
+
+The node client certificate must have both the `serverAuth` and `clientAuth` Extended Key Usages (EKUs), or no EKU extension at all, so that receiving nodes can identify it as a node certificate.
+
+User certificates (for X.509 client certificate authentication) must share a root CA with the node's client certificate.
+
+| Format               | Syntax                                      |
+|:---------------------|:--------------------------------------------|
+| Command line         | `--node-client-certificate-file`            |
+| YAML                 | `NodeClientCertificateFile`                 |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_FILE`    |
+
+| Format               | Syntax                                          |
+|:---------------------|:------------------------------------------------|
+| Command line         | `--node-client-certificate-password`            |
+| YAML                 | `NodeClientCertificatePassword`                 |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_PASSWORD`    |
+
+| Format               | Syntax                                                 |
+|:---------------------|:-------------------------------------------------------|
+| Command line         | `--node-client-certificate-private-key-file`           |
+| YAML                 | `NodeClientCertificatePrivateKeyFile`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_PRIVATE_KEY_FILE`   |
+
+| Format               | Syntax                                                     |
+|:---------------------|:-----------------------------------------------------------|
+| Command line         | `--node-client-certificate-private-key-password`           |
+| YAML                 | `NodeClientCertificatePrivateKeyPassword`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD`   |
+
+### Node client certificate store (Windows)
+
+<Badge text="Experimental: Subject to change" type="warning" vertical="middle"/>
+
+You can also load the node client certificate from the Windows certificate store.
+
+| Format               | Syntax                                                |
+|:---------------------|:------------------------------------------------------|
+| Command line         | `--node-client-certificate-store-location`            |
+| YAML                 | `NodeClientCertificateStoreLocation`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_STORE_LOCATION`    |
+
+| Format               | Syntax                                            |
+|:---------------------|:--------------------------------------------------|
+| Command line         | `--node-client-certificate-store-name`            |
+| YAML                 | `NodeClientCertificateStoreName`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_STORE_NAME`    |
+
+| Format               | Syntax                                            |
+|:---------------------|:--------------------------------------------------|
+| Command line         | `--node-client-certificate-thumbprint`            |
+| YAML                 | `NodeClientCertificateThumbprint`                 |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_THUMBPRINT`    |
+
+| Format               | Syntax                                              |
+|:---------------------|:----------------------------------------------------|
+| Command line         | `--node-client-certificate-subject-name`            |
+| YAML                 | `NodeClientCertificateSubjectName`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_CERTIFICATE_SUBJECT_NAME`    |
+
+| Format               | Syntax                                                           |
+|:---------------------|:-----------------------------------------------------------------|
+| Command line         | `--node-client-trusted-root-certificate-store-location`          |
+| YAML                 | `NodeClientTrustedRootCertificateStoreLocation`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_TRUSTED_ROOT_CERTIFICATE_STORE_LOCATION`  |
+
+| Format               | Syntax                                                       |
+|:---------------------|:-------------------------------------------------------------|
+| Command line         | `--node-client-trusted-root-certificate-store-name`          |
+| YAML                 | `NodeClientTrustedRootCertificateStoreName`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_TRUSTED_ROOT_CERTIFICATE_STORE_NAME`  |
+
+| Format               | Syntax                                                       |
+|:---------------------|:-------------------------------------------------------------|
+| Command line         | `--node-client-trusted-root-certificate-thumbprint`          |
+| YAML                 | `NodeClientTrustedRootCertificateThumbprint`                 |
+| Environment variable | `KURRENTDB_NODE_CLIENT_TRUSTED_ROOT_CERTIFICATE_THUMBPRINT`  |
+
+| Format               | Syntax                                                         |
+|:---------------------|:---------------------------------------------------------------|
+| Command line         | `--node-client-trusted-root-certificate-subject-name`          |
+| YAML                 | `NodeClientTrustedRootCertificateSubjectName`                  |
+| Environment variable | `KURRENTDB_NODE_CLIENT_TRUSTED_ROOT_CERTIFICATE_SUBJECT_NAME`  |
+
 ## Certificate generation tool
 
 Kurrent provides the interactive Certificate Generation CLI, which creates certificates signed by a private, auto-generated CA for KurrentDB. You can use the [configuration wizard](https://configurator.eventstore.com), that will provide you exact CLI commands that you need to run to generate certificates matching your configuration.

docs/server/security/user-authentication.md

@@ -114,7 +114,7 @@ For using X.509 user certificate with KurrentDB client from an application, refe
 
 The user certificate must adhere to the following requirements:
 
-- The certificate has a root CA in common with the node certificate.
+- The certificate has a root CA in common with the node's client certificate.
 - The root CA that they have in common is trusted by the node.
 - The certificate has the ClientAuth EKU, and not the ServerAuth EKU.
 - The certificate must be in date.
@@ -252,7 +252,7 @@ Signature Hash: 6d922badaba2372070f13c69b620286262eab1d8d2d2156a271a1d73aaaf64e4
 | Error                                     | Solution                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 |:------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | Feature not enabled                        | The feature has to be enabled in order to authenticate user requests.<br/><br/> The following log indicates that the feature was not enabled: `UserCertificatesPlugin is not enabled`.                                                                                                                                                                                                                                                                                                                             |
-| Feature enabled and user not authenticated | If the feature has been enabled but there are still access denied errors, check the following: <ul><li>The user exists and is enabled in the KurrentDB database. Can you log in with the username and password?</li><li>The user certificate is valid, and has a valid chain up to a trusted root CA.</li><li>The user certificate and node certificate share a common root CA.</li><li>Use 'requires leader' (which is the default) in your client configuration to rule out issues with forwarding requests.</li></ul> |
+| Feature enabled and user not authenticated | If the feature has been enabled but there are still access denied errors, check the following: <ul><li>The user exists and is enabled in the KurrentDB database. Can you log in with the username and password?</li><li>The user certificate is valid, and has a valid chain up to a trusted root CA.</li><li>The user certificate and the node's client certificate share a common root CA.</li><li>Use 'requires leader' (which is the default) in your client configuration to rule out issues with forwarding requests.</li></ul> |
 
 ## LDAP authentication