Google forced separate client and server PKIs.[1]

[1] https://letsencrypt.org/2025/05/14/ending-tls-client-authent...