ERR_SSL_KEY_USAGE_INCOMPATIBLE: Fix Guide
ERR_SSL_KEY_USAGE_INCOMPATIBLE means the certificate does not include TLS Web Server Authentication (OID 1.3.6.1.5.5.7.3.1) in extKeyUsage. Chrome considers such a cert unfit for HTTPS. Causes: cert issued for S/MIME, code signing, client auth. Fix: request a cert with the correct extKeyUsage from your CA, or reissue via Let's Encrypt.
This error blocks HTTPS access. Below: causes, fixes, working config, FAQ.
Common Causes
- Certificate issued for S/MIME (email), not TLS
- Code-signing cert mistakenly installed on a web server
- Client-authentication (mTLS) cert deployed instead of a server cert
- Corporate CA issued only keyEncipherment without extKeyUsage
- Old cert without extKeyUsage (modern browsers require it explicitly)
Step-by-Step Fix
- Check extKeyUsage:
openssl x509 -in cert.pem -text | grep -A1 "Extended Key Usage" - It must contain:
TLS Web Server Authentication - Let's Encrypt always issues certs with the correct serverAuth — reissue
- Commercial CA: order "SSL Server Certificate", not "Code Signing"
- Inspect SSL via SSL Checker — you will see every extension
Example: Proper nginx TLS config
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
ssl_stapling on;
ssl_stapling_verify on;
}Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
How-to
Frequently Asked Questions
What is extKeyUsage?
Extended Key Usage — an X.509 extension listing what the cert is for: serverAuth, clientAuth, codeSigning, emailProtection. Browsers require serverAuth for HTTPS.
Why did it work before?
Old browsers did not enforce extKeyUsage strictly. Chrome 82+ requires serverAuth explicitly. A cert that worked 5 years ago is now blocked.
Can I add extKeyUsage to an existing cert?
No — the cert is signed by the CA. Changing its structure invalidates the signature. Only a reissue fixes it.
Is Let's Encrypt always fine?
Yes. All ACME certs are issued with <code>serverAuth,clientAuth</code> in extKeyUsage. Universal format.