ERR_SSL_KEY_USAGE_INCOMPATIBLE

Question

Whenever I try to access an on premise machine that has a self-signed certificate assigned to it, Microsoft Edge will give me the ERR_SSL_KEY_USAGE_INCOMPATIBLE error message in return. I've never encountered this error before when accessing this machine. Does Edge no longer allow you to access sites that have self-signed certificates assigned to it?

Answer 1

Hi @Benjamin Bell

You can try the workaround to resolve this issue:

1. After win+r opens, enter "regedit" and navigate as follows: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge.

2.Create new DWORD entry named:  RSAKeyUsageForLocalAnchorsEnabled

3.Set the value to:  0x00000000 (0)

Note:  Create the above registry location if it does not already exist.

The appropriate solution is for the server certificate to be re-issued with the correct keyUsage bits set.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. Regards, Jinxin

Answer 2

While Jinxin Wang does provide a functioning workaround, I suggest creating a proper certificate.

I suppose you created the certificate via IIS Manager. This will only set one key usage flag: "Key Encipherment".

Instead, you should create a proper, certificate using PowerShell and a key usage flag of "Digital Signature".

Google states the reason behind that decision here:

https://chromeenterprise.google/policies/#RSAKeyUsageForLocalAnchorsEnabled

Connections which fail this check will fail with the error ERR_SSL_KEY_USAGE_INCOMPATIBLE. Sites which fail with this error likely have a misconfigured certificate. Modern ECDHE_RSA cipher suites use the "digitalSignature" key usage option, while legacy RSA decryption cipher suites use the "keyEncipherment" key usage option. If unsure, adminstrators should include both in RSA certificates meant for HTTPS.