ERR_SSL_KEY_USAGE_INCOMPATIBLE: Fix Guide

• Certificate issued for S/MIME (email), not TLS
• Code-signing cert mistakenly installed on a web server
• Client-authentication (mTLS) cert deployed instead of a server cert
• Corporate CA issued only keyEncipherment without extKeyUsage
• Old cert without extKeyUsage (modern browsers require it explicitly)

1. Check extKeyUsage: openssl x509 -in cert.pem -text | grep -A1 "Extended Key Usage"
2. It must contain: TLS Web Server Authentication
3. Let's Encrypt always issues certs with the correct serverAuth — reissue
4. Commercial CA: order "SSL Server Certificate", not "Code Signing"
5. Inspect SSL via SSL Checker — you will see every extension

Check SSL Certificate →

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_stapling        on;
    ssl_stapling_verify on;
}

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The ERR_SSL_KEY_USAGE_INCOMPATIBLE error indicates that the SSL certificate being used is not suitable for server authentication due to incorrect key usage attributes. This typically arises when the certificate does not include the necessary key usage extensions, such as 'Digital Signature' or 'Key Encipherment'. To resolve this, ensure that your SSL certificate is correctly issued for server authentication by checking its configuration and key usage settings.

SSL certificates contain specific fields that dictate their usage, primarily 'Key Usage' and 'Extended Key Usage'. These fields determine the operations for which the certificate can be used. The 'Key Usage' extension specifies the basic functions of the key, while 'Extended Key Usage' delineates more specific purposes.

For server authentication, the following key usage attributes must be present:

• Digital Signature: Allows the key to be used to sign data.
• Key Encipherment: Permits the key to be used for encrypting keys.

If these attributes are missing or incorrectly configured, clients will reject the certificate, leading to the ERR_SSL_KEY_USAGE_INCOMPATIBLE error.

Checking Key Usage Attributes

To verify the key usage attributes of your SSL certificate, you can use the OpenSSL command-line tool. Here’s how to extract the key usage information:

openssl x509 -in your_certificate.crt -text -noout

This command will output various details about the certificate, including its key usage. Look for the 'Key Usage' and 'Extended Key Usage' sections to ensure they include the appropriate values for server authentication.

When generating an SSL certificate, it is critical to specify the correct attributes to avoid the ERR_SSL_KEY_USAGE_INCOMPATIBLE error. Below is an example of how to create a Certificate Signing Request (CSR) with the appropriate key usage settings using OpenSSL.

Creating a CSR with Key Usage Extensions

First, create a configuration file (e.g., openssl.cnf) with the following content:

[ req ]
default_bits       = 2048
prompt             = no
distinguished_name = req_distinguished_name
req_extensions     = v3_req

[ req_distinguished_name ]
C  = US
ST = California
L  = San Francisco
O  = Example Company
CN = www.example.com

[ v3_req ]
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

Next, generate the CSR using this configuration file:

openssl req -new -key your_private_key.key -out your_csr.csr -config openssl.cnf

This command ensures that your CSR includes the necessary key usage attributes for server authentication. Once the CSR is generated, submit it to a Certificate Authority (CA) for signing.

Verifying the Issued Certificate

After receiving the signed certificate, you can verify that it contains the correct key usage attributes by running the OpenSSL command again:

openssl x509 -in your_signed_certificate.crt -text -noout

Check the output to ensure that the 'Key Usage' and 'Extended Key Usage' fields include the required attributes. If they do not, you will need to reissue the certificate with the correct settings.