Browser errors
SEC_ERROR_INADEQUATE_KEY_USAGE in Firefox: causes and fixes
SEC_ERROR_INADEQUATE_KEY_USAGESEC_ERROR_INADEQUATE_KEY_USAGE means a certificate in the chain is not permitted to do what it is being asked to do. Every certificate can declare allowed uses in its key usage extension; if the server certificate cannot sign handshakes, or a CA certificate cannot sign other certificates, Firefox refuses the connection.
Is it the site or your device?
Usually the site's certificate is homemade or misissued; stale Firefox data is the less common local cause. Check the server's certificate with the SSL checker:
curl ssl.sh/example.com
- The checker flags the key usage, or the site uses a homemade certificate: the certificate has to be reissued. As a visitor, there is nothing safe to do.
- The checker is clean and other browsers work: look at Firefox. Open Settings > Privacy & Security > Certificates > View Certificates and check the Authorities tab for a certificate named after the site or device. A server certificate imported there as a CA is a frequently reported cause; delete it and use the site's normal certificate instead.
Causes
1. Server certificate lacks digitalSignature
Modern TLS key exchange (ECDHE) requires the server to sign handshake data. A certificate whose key usage lists only keyEncipherment fails. Inspect it:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -ext keyUsage,extendedKeyUsage,basicConstraints
2. CA certificate lacks keyCertSign
An internal CA built without keyCertSign in its key usage cannot validly issue certificates. Firefox rejects anything below it.
3. Server certificate imported as a CA
If someone imported a site's certificate into the Authorities tab to silence a warning, Firefox now treats it as a CA. Without keyCertSign it fails with this code.
4. Device certificates with unusual key usage
Some routers, printers and appliances generate certificates with key usage meant for other purposes. Firmware updates or uploading a properly generated certificate fixes it.
5. Stale profile data
Old exceptions or imported certificates in the profile's cert9.db can conflict with a new certificate. Test with a fresh profile from about:profiles.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed" or "Warning: Potential Security Risk Ahead" with SEC_ERROR_INADEQUATE_KEY_USAGE |
| Chrome / Edge | ERR_SSL_KEY_USAGE_INCOMPATIBLE or NET::ERR_CERT_INVALID |
| Safari | "This Connection Is Not Private" |
| OpenSSL | unsuitable certificate purpose during verification |
How site owners fix it
A certificate with the right key usage, from a public CA or a correctly configured internal CA, fixes it.
1. Use a public certificate where possible. Public CAs issue certificates with correct key usage by default.
2. Reissue internal certificates with the right extensions. For the server certificate:
printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:example.com\n" > server.ext
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
-days 200 -extfile server.ext -out server.crt
For the CA certificate, include basicConstraints=critical,CA:TRUE and keyUsage=critical,keyCertSign,cRLSign.
3. Decode before deploying. Paste the result into the certificate decoder and confirm each extension, then test with curl ssl.sh/example.com and Firefox.
FAQ
What key usage should a TLS server certificate have?
digitalSignature is required for modern ECDHE handshakes and for any ECDSA key. RSA certificates traditionally also carry keyEncipherment. The extended key usage should include serverAuth, and basicConstraints should say CA:FALSE.
Can I delete Firefox's certificate database to fix it?
Users report that removing cert9.db from a closed Firefox profile sometimes clears this error, because it removes stale imported certificates and exceptions. It also deletes every certificate you imported yourself, so first try removing the specific certificate under Settings > Certificates > View Certificates.
Does Chrome show the same error?
Chrome reports key usage problems as ERR_SSL_KEY_USAGE_INCOMPATIBLE or NET::ERR_CERT_INVALID, depending on the version and whether the certificate chains to a locally installed root.
Is it safe to add an exception for this error?
Firefox does not normally offer one for this code, and that is intentional: the certificate is being used for something its issuer did not allow. Fix the certificate instead.