SEC_ERROR_INADEQUATE_KEY_USAGE
SEC_ERROR_INADEQUATE_KEY_USAGE — Firefox: cert carries a Key Usage extension (keyUsage) but lacks the required bits for server auth. Needed: digitalSignature + keyEncipherment (RSA) or digitalSignature (ECDSA). Or Extended Key Usage (EKU) is missing serverAuth. Fix: reissue via the CA with correct extensions.
Below: causes, fixes, FAQ.
Common Causes
- Cert issued without digitalSignature/keyEncipherment
- Extended Key Usage lacks
TLS Web Server Authentication - CA compromise forced narrow key-usage restriction
- Reused client cert as server (wrong EKU)
- Code-signing cert pressed into HTTPS duty (wrong EKU)
Step-by-Step Fix
- Reissue via Let's Encrypt — EKU + Key Usage correct by default
- Check:
openssl x509 -in cert.pem -text | grep -A2 "Key Usage" - Required bits: Digital Signature + Key Encipherment for RSA
- Required EKU: TLS Web Server Authentication
- Enterno SSL Checker — highlights missing KU
Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
Frequently Asked Questions
Key Usage vs EKU?
Key Usage — primary: what the cert can do cryptographically (sign, encrypt). EKU — constraining: for which applications it is allowed (server auth, client auth, email, code signing).
Minimum set for HTTPS?
RSA: KU=digitalSignature,keyEncipherment + EKU=serverAuth. ECDSA: KU=digitalSignature + EKU=serverAuth.
Adjust private CA?
Yes. In OpenSSL config: <code>keyUsage=digitalSignature,keyEncipherment</code> + <code>extendedKeyUsage=serverAuth</code>.
Is Firefox stricter than Chrome?
Firefox historically stricter on KU validation. Chrome also checks but sometimes warns less loudly.