verify error:num=26:unsuitable certificate purpose

s_client prints "verify error:num=26:…" and "Verify return code: 26 (…)"; openssl verify prints "error 26 at <depth> depth lookup: unsuitable certificate purpose". Go reports the same problem as "x509: certificate specifies an incompatible key usage".

OpenSSL CLI (openssl s_client / openssl verify -purpose) — X509_V_ERR_INVALID_PURPOSE

What it means

OpenSSL error 26 (X509_V_ERR_INVALID_PURPOSE): the chain is otherwise valid, but a certificate's extensions do not allow the purpose being checked. s_client checks the server certificate for the TLS server purpose, so a certificate whose extendedKeyUsage lists only clientAuth (or emailProtection) fails; openssl verify checks whatever -purpose you give.

Why it happens

• The extendedKeyUsage does not include serverAuth

  common

  Certificates from client-authentication or S/MIME templates installed on a server, or an EKU written by hand without serverAuth.

• A CA certificate is used as a server certificate

  occasional

  Serving a certificate with keyUsage limited to keyCertSign/cRLSign fails the TLS server purpose checks.

• An intermediate's EKU excludes the purpose

  occasional

  OpenSSL checks purposes up the chain; an intermediate restricted to other usages makes its leaves unsuitable for TLS servers.

How to fix it

1. 1.

   Read the usage extensions

   extendedKeyUsage, keyUsage and basicConstraints tell you what the certificate may be used for; openssl verify -purpose checks a specific purpose.

   openssl x509 -in server.pem -noout -ext extendedKeyUsage,keyUsage,basicConstraints
   # Check against the purpose you need: sslserver, sslclient, smimesign, ...
   openssl verify -CAfile root.pem -purpose sslserver server.pem

2. 2.

   Reissue for the right purpose

   A TLS server certificate needs serverAuth in extendedKeyUsage (if the extension is present) and digitalSignature in keyUsage.

   openssl req -new -key server.key -out server.csr -subj "/CN=api.example.com" \
     -addext "subjectAltName=DNS:api.example.com" -addext "extendedKeyUsage=serverAuth"

← Browse the full signature error database