| Previous | Next |
| SEC_E_NO_KERB_KEY | SEC_E_DOWNGRADE_DETECTED |
SEC_E_CERT_WRONG_USAGE
SEC_E_CERT_WRONG_USAGE means that the certificate is not authorized for the requested purpose. A certificate may be otherwise valid and trusted while its enhanced key usage or other constraints exclude the role in which it is being presented.
Examples
- A certificate intended for client authentication is presented as a server certificate.
- A service requires an EKU such as Server Authentication, but the certificate does not permit it.
- Local certificate properties narrow the uses beyond what the certificate extension alone allows.
What to do
Inspect the effective EKU and key-usage constraints, then issue or select a certificate for the exact client or server role. Replacing it with a broadly trusted but wrong-purpose certificate is not a valid fix.
Microsoft: CertGetEnhancedKeyUsage · SSPI Status Codes
Looking for a different code? Search another status or error code.