title: Firefox SEC_ERROR_INADEQUATE_CERT_TYPE with NO Enhanced Key Usage
body: <p>I have spent my entire afternoon trying to create a CA that Firefox will work with, every attempt has worked with:</p>
  
  <ul>
  <li>Microsoft Edge</li>
  <li>Microsoft IE 11</li>
  <li>Google Chrome 59</li>
  <li>Opera 46</li>
  <li>wget 1.17.1</li>
  <li>curl 7.47.0</li>
  </ul>
  
  <p>... but not Firefox 54.0.1 which just consistently throws SEC_ERROR_INADEQUATE_CERT_TYPE and refuses to talk to the server. I've removed the Enhanced Key Usage of All Application Policies from Root CA as per <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1049176" rel="noreferrer">https://bugzilla.mozilla.org/show_bug.cgi?id=1049176</a>, but it still doesn't work..... What am I missing? I'm out of ideas....</p>
  
  <h1>Latest attempt</h1>
  
  <p>Apologies for this massive section, but this is everything Windows will tell me about the current attempt to make this work; hopefully someone will spot what the issue is!!!</p>
  
  <h2>Root CA</h2>
  
  <ul>
  <li>Version: V3</li>
  <li>Serial: ‎33 9c 48 f4 0a 2f fc 4e</li>
  <li>Signature Alogr: sha256RSA</li>
  <li>Signature Hash Algor.: sha256</li>
  <li>Issuer: C=GB, O=Org Name Here, CN=Org Name Root CA</li>
  <li>Valid From: ‎02 ‎July ‎2017 19:38:24</li>
  <li>Valid To: ‎02 ‎July ‎2047 19:38:24</li>
  <li>Subject: C=GB, O=Org Name Here, CN=Org Name Root CA</li>
  <li>Public Key: RSA 2048-bit</li>
  <li>Public Key Params: 05 00</li>
  <li>Authority Key Identifier: KeyID=d3 f2 2f 78 c2 db 20 d7 63 72 fd d8 54 be 75 2c fe ef d3 3f</li>
  <li>Certificate Policies: [1]Certificate Policy:
   Policy Identifier=1.3.6.1.4.1.[OrgPEN].1.1 [1,1]Policy Qualifier Info: Policy Qualifier Id=CPS Qualifier: <a href="http://pki.orgname.fqdn/cps" rel="noreferrer">http://pki.orgname.fqdn/cps</a></li>
  <li>Subject Key ID: d3 f2 2f 78 c2 db 20 d7 63 72 fd d8 54 be 75 2c fe ef d3 3f</li>
  <li>Basic Constraints: Subject Type=CA Path Length Constraint=None</li>
  </ul>
  
  <h2>Issuing CA</h2>
  
  <ul>
  <li>Version: V3</li>
  <li>Serial: ‎15 6c 30 6d d8 f1 eb b0</li>
  <li>Signature Alogr: sha256RSA</li>
  <li>Signature Hash Algor.: sha256</li>
  <li>Issuer: C=GB, O=Org Name Here, CN=Org Name Root CA</li>
  <li>Valid From: ‎02 ‎July ‎2017 19:40:02</li>
  <li>Valid To: ‎02 ‎July ‎2027 19:40:02</li>
  <li>Subject: C=GB, O=Org Name Here, CN=Org Name Issuing CA</li>
  <li>Public Key: RSA 2048-bit</li>
  <li>Public Key Params: 05 00</li>
  <li>Authority Key Identifier: KeyID=d3 f2 2f 78 c2 db 20 d7 63 72 fd d8 54 be 75 2c fe ef d3 3f</li>
  <li>Authority Information Access: [1]Authority Information Access Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2) Alternative Name: URL=<a href="http://pki.orgname.fqdn/aia/OrgName-RootCA.crt" rel="noreferrer">http://pki.orgname.fqdn/aia/OrgName-RootCA.crt</a> [2]Authority Information Access Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1) Alternative Name: URL=<a href="http://pki.orgname.fqdn/ocsp" rel="noreferrer">http://pki.orgname.fqdn/ocsp</a></li>
  <li>Certificate Policies: [1]Certificate Policy: Policy Identifier=1.3.6.1.4.1.[OrgPEN].1.1 [1,1]Policy Qualifier Info: Policy Qualifier Id=CPS Qualifier: <a href="http://pki.orgname.fqdn/cps" rel="noreferrer">http://pki.orgname.fqdn/cps</a></li>
  <li>Enhanced Key Usage: Any Purpose (2.5.29.37.0)</li>
  <li>CRL Distribution Points: [1]CRL Distribution Point Distribution Point Name: Full Name: URL=<a href="http://pki.orgname.fqdn/cdp/OrgName-RootCA.crl" rel="noreferrer">http://pki.orgname.fqdn/cdp/OrgName-RootCA.crl</a> CRL Issuer: Directory Address: C=GB O=Org Name Here CN=OrgName Root CA</li>
  <li>Subject Key ID: 47 42 f0 e5 bb 39 76 9d ed 94 ca a6 b6 50 fb 24 37 19 a0 3a</li>
  <li>Basic Constraints: Subject Type=CA Path Length Constraint=None</li>
  <li>Key Usage: Certificate Signing, Off-line CRL Signing, CRL Signing (06)</li>
  </ul>
  
  <h2>Test Web Server Certificate</h2>
  
  <ul>
  <li>Version: V3</li>
  <li>Serial: ‎‎50 f6 be 8d ab db df 21</li>
  <li>Signature Alogr: sha256RSA</li>
  <li>Signature Hash Algor.: sha256</li>
  <li>Issuer: C=GB, O=Org Name Here, CN=Org Name Root CA</li>
  <li>Valid From: ‎02 ‎July ‎2017 19:48:11</li>
  <li>Valid To: ‎‎02 ‎July ‎2019 19:48:11</li>
  <li>Subject: C=GB, O=Org Name Here, CN=servername.orgname.fqdn</li>
  <li>Public Key: RSA 2048-bit</li>
  <li>Public Key Params: 05 00</li>
  <li>Authority Key Identifier:KeyID=47 42 f0 e5 bb 39 76 9d ed 94 ca a6 b6 50 fb 24 37 19 a0 3a</li>
  <li>Authority Information Access: [1]Authority Information Access Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2) Alternative Name: URL=<a href="http://pki.orgname.fqdn/aia/OrgName-IssuingCA.crt" rel="noreferrer">http://pki.orgname.fqdn/aia/OrgName-IssuingCA.crt</a> [2]Authority Information Access Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1) Alternative Name: URL=<a href="http://pki.orgname.fqdn/ocsp" rel="noreferrer">http://pki.orgname.fqdn/ocsp</a></li>
  <li>Freshest CRL: [1]Freshest CRL Distribution Point Name: Full Name: URL=<a href="http://pki.orgname.fqdn/cdp/OrgName-IssuingCA-Delta.crl" rel="noreferrer">http://pki.orgname.fqdn/cdp/OrgName-IssuingCA-Delta.crl</a></li>
  <li>Subject Alt Names: DNS Name=servername.orgname.fqdn DNS Name=freindlyname.orgname.fqdn IP Address=192.0.2.4 IP Address=2001:DB8:1234:4321:0000:0000:0000:1234</li>
  <li>Certificate Policies: [1]Certificate Policy: Policy Identifier=1.3.6.1.4.1.[OrgPEN].1.1 [1,1]Policy Qualifier Info: Policy Qualifier Id=CPS Qualifier: <a href="http://pki.orgname.fqdn/cps" rel="noreferrer">http://pki.orgname.fqdn/cps</a></li>
  <li>Enhanced Key Usage: Server Authentication (1.3.6.1.5.5.7.3.1)</li>
  <li>CRL Distribution Points: [1]CRL Distribution Point Distribution Point Name: Full Name: URL=<a href="http://pki.orgname.fqdn/cdp/OrgName-IssuingCA.crl" rel="noreferrer">http://pki.orgname.fqdn/cdp/OrgName-IssuingCA.crl</a> CRL Issuer: Directory Address: C=GB O=Org Name Here CN=OrgName Root CA</li>
  <li>Subject Key ID: b9 50 13 7d bc eb dd 92 b9 03 b7 86 e0 00 dc f7 2f ea 56 20</li>
  <li>Basic Constraints: Subject Type=End Entity Path Length Constraint=None</li>
  <li>Key Usage: Digital Signature, Key Encipherment (a0)</li>
  </ul>
  
  <p>Why is it always Firefox that causes problems??? Even Edge works.....</p>