"ERR_SSL_KEY_USAGE_INCOMPATIBLE" when attempting to access Panorama from Chromium-based browsers (Microsoft Edge and Google Chrome)

"ERR_SSL_KEY_USAGE_INCOMPATIBLE" when attempting to access Panorama from Chromium-based browsers (Microsoft Edge and Google Chrome)

29419
Created On 01/30/24 20:30 PM - Last Modified 01/29/25 07:16 AM


Symptom


  • SSL-TLS profile with certificates has been configured for HTTPS authentication to Panorama.
  • SSH is working without any issues. 
  • Can access Panorama instance via Firefox and Issue is only with Chromium-based browsers


Environment


  • Panorama
  • PAN-OS 8.1 and above
  • Chromium-based browsers
  • SSL-TLS profile configured


Cause


ERR_SSL_KEY_USAGE_INCOMPATIBLE error will occur due to a misconfigured certificate as it might not be compatible with the Chromium browser as the Chrome security update added a certificate "Key Usage" check.

Resolution


  1. If the issue is with a particular user, then try creating a new registry as per the below steps:
1. Access Registry Editor as an administrator.
2. Go to Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
3. Add a new DWORD (32-bit) Value
4. Name it: RSAKeyUsageForLocalAnchorsEnabled
5. Keep value as the default (00000000)
6. Close Google Chrome and try accessing instance again
  1. If the issue is with all users then delete the SSL TLS profile used for HTTPS access, so that the default certificate will be used for management access. 
> configure
# delete deviceconfig system ssl-tls-service-profile
# delete panorama ssl-tls-service-profile "profile-name"
# commit
# exit
  1. If removing SSL/TLS-service-profile is not a feasible option then try to generate a certificate from the third party that must have the "keyUsage=digitalSignature,key encipherment,data encipherment" or use a Non-CA signed certificate in the ssl/tls profile, self-signed certificate.

  2. If the issue is with a firewall/panorama self-signed CA certificate then generate a non-CA certificate, ideally one signed by the CA certificate created earlier, and attach this new certificate to the management interface. This will add the necessary fields to the 'Key Usage' section, allowing it to pass browser validation.

 

echo | openssl s_client -connect 10.194.43.103:443 -servername 10.194.43.103 -showcerts 2>/dev/null | openssl x509 -noout -text | grep "Key Usage" -A 1
            X509v3 Key Usage:
                Digital Signature, Key Encipherment, Data Encipherment, Key Agreement



Additional Information


Note: Please make sure the SSL-TLS-certificate configured is not expired and if the above solution does not work then try setting the max TLS version to 1.2 and check whether the issue persists.

Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000XhgTCAS&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail