3

I have successfully installed Sitecore XP 9.3 , but when launching the URL facing issue.

The browser error is: ERR_SSL_KEY_USAGE_INCOMPATIBLE

ERR_SSL_KEY_USAGE_INCOMPATIBLE

Not finding any error in logs, unable to understand what is the issue.

1
  • did you check IIS is not stopped or check entry in host file? Commented Oct 30, 2023 at 15:33

2 Answers 2

5

I can see ERR_SSL_KEY_USAGE_INCOMPATIBLE error message on your screenshot.

I found and article from Łukasz Skowroński, explaining how to fix the issue here:

http://sitecore.skowronski.it/sitecore/sitecore-and-err_ssl_key_usage_incompatible-error-in-the-browser-windows-11/

In nutshell:

  • Open IIS Manager
  • Find your site
  • Edit bindings
  • Check Disable TLS 1.3 over TCP checkbox
  • Restart IIS
1

Firstly while I tried to analyse the error shown “ERR_SSL_KEY_USAGE_INCOMPATIBLE”, it seems that the error is related to Key Usage parameter that is available in my already created Self Signed certificate by Sitecore. So when I see my existing self signed cetificate, I could see that the value of Key Usage property is “Data Encipherment (10)”

enter image description here

So I tried to change the value of Key usage which is currently “Data Encipherment” to “Digital Signature”. But as we all know that Certificates are signed. The signature covers all the certificate contents, including the Key Usage extension. You cannot change anything in the certificate contents, not the smallest bit, without invalidating the signature. So no, you cannot “change” a certificate.

So I decided to crete a new certificate with the same details but with Key usage as Digital Signature

To begin, open PowerShell and run the following command to create a new self-signed certificate. Set the DNS name to match the hostname of your Sitecore server, specify the certificate location, and make sure the KeyUsage is set to “DigitalSignature”.

New-SelfSignedCertificate -FriendlyName HostName -DnsName HostName -CertStoreLocation Cert:\LocalMachine\My -KeyUsage DigitalSignature

enter image description here

To apply your changes, navigate to the “Sites” folder in the left-hand tree structure of the IIS Manager and find your website. Right-click on it and choose “Edit Bindings”. In the box that pops up, select your site binding and choose “Edit” from the right-hand menu.

This will open a new window. At the bottom of this window, you’ll see a dropdown chooser labeled “SSL Certificate”. Use this dropdown to select your certificate. Click “OK” when you’re done.

enter image description here

Now, when you go back to Chrome and browse the site, you’ll be met with the following message. This is because Chrome doesn’t instantly recognize the new self-signed certificate that you’ve added.

enter image description here

To progress past this warning, click the “Advanced” button on the bottom left to reveal the link to proceed.

Sometimes you will get error related to certifcate not trusted etc, while syncing items with TDS. So in that case you can just copy the same certificate to Trusted Root and that is it. This should work.

I am providing link to my blog post : https://codeandlearnspot.wordpress.com/2024/01/29/solving-chrome-err_ssl_key_usage_incompatible/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.