# SEC_ERROR_INADEQUATE_KEY_USAGE in Firefox: causes and fixes

> SEC_ERROR_INADEQUATE_KEY_USAGE means a certificate's key usage does not allow the operation. Common with homemade certs, device certs and stale Firefox data.

Source: https://ssl.sh/errors/sec-error-inadequate-key-usage/
Last updated: 2026-11-10

**SEC_ERROR_INADEQUATE_KEY_USAGE means a certificate in the chain is not permitted to do what it is being asked to do.** Every certificate can declare allowed uses in its key usage extension; if the server certificate cannot sign handshakes, or a CA certificate cannot sign other certificates, Firefox refuses the connection.

## Is it the site or your device?

Usually the site's certificate is homemade or misissued; stale Firefox data is the less common local cause. Check the server's certificate with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker flags the key usage, or the site uses a homemade certificate:** the certificate has to be reissued. As a visitor, there is nothing safe to do.
- **The checker is clean and other browsers work:** look at Firefox. Open Settings > Privacy & Security > Certificates > View Certificates and check the Authorities tab for a certificate named after the site or device. A server certificate imported there as a CA is a frequently reported cause; delete it and use the site's normal certificate instead.

## Causes

### 1. Server certificate lacks digitalSignature

Modern TLS key exchange (ECDHE) requires the server to sign handshake data. A certificate whose key usage lists only `keyEncipherment` fails. Inspect it:

```bash
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -ext keyUsage,extendedKeyUsage,basicConstraints
```

### 2. CA certificate lacks keyCertSign

An internal CA built without `keyCertSign` in its key usage cannot validly issue certificates. Firefox rejects anything below it.

### 3. Server certificate imported as a CA

If someone imported a site's certificate into the Authorities tab to silence a warning, Firefox now treats it as a CA. Without `keyCertSign` it fails with this code.

### 4. Device certificates with unusual key usage

Some routers, printers and appliances generate certificates with key usage meant for other purposes. Firmware updates or uploading a properly generated certificate fixes it.

### 5. Stale profile data

Old exceptions or imported certificates in the profile's `cert9.db` can conflict with a new certificate. Test with a fresh profile from `about:profiles`.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed" or "Warning: Potential Security Risk Ahead" with `SEC_ERROR_INADEQUATE_KEY_USAGE` |
| Chrome / Edge | [ERR_SSL_KEY_USAGE_INCOMPATIBLE](https://ssl.sh/errors/err-ssl-key-usage-incompatible/) or [NET::ERR_CERT_INVALID](https://ssl.sh/errors/net-err-cert-invalid/) |
| Safari | "This Connection Is Not Private" |
| OpenSSL | `unsuitable certificate purpose` during verification |

## How site owners fix it

A certificate with the right key usage, from a public CA or a correctly configured internal CA, fixes it.

**1. Use a public certificate where possible.** Public CAs issue certificates with correct key usage by default.

**2. Reissue internal certificates with the right extensions.** For the server certificate:

```bash
printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:example.com\n" > server.ext
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -days 200 -extfile server.ext -out server.crt
```

For the CA certificate, include `basicConstraints=critical,CA:TRUE` and `keyUsage=critical,keyCertSign,cRLSign`.

**3. Decode before deploying.** Paste the result into the [certificate decoder](https://ssl.sh/tools/certificate-decoder/) and confirm each extension, then test with `curl ssl.sh/example.com` and Firefox.