Firefox 连接https出现sec_error_inadequate_cert_type的解决办法

Firefox 连接https出现sec_error_inadequate_cert_type，但是IE和chrome一般不会出现，严格的说，这不是Firefox的bug，这是Firefox要求严格所致。
出现这个问题一般是证书出现了问题。

openssl x509 -in localhost.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 15 (0xf)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=AT, ST=STMK, L=Graz, O=Bee Company, OU=Root CA, CN=example.com/name=rootca/emailAddress=[e-mail]
        Validity
            Not Before: Aug 13 12:36:41 2013 GMT
            Not After : Aug 11 12:36:41 2023 GMT
        Subject: C=AT, ST=STMK, L=Graz, O=sslvpn.com.at, OU=changeme, CN=howard.example.com/name=howard.example.com/emailAddress=[e-mail]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    NOTHING_TO_READ_HERE :)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                Easy-RSA Generated Certificate
            X509v3 Subject Key Identifier:
                NOTHING_TO_READ_HERE :)
            X509v3 Authority Key Identifier:
                keyid:NOTHING_TO_READ_HERE :)
                DirName:/C=AT/ST=STMK/L=Graz/O=sslvpn Company/OU=Root CA/CN=example.com/name=rootca/emailAddress=[e-mail]
                serial:NOTHING_TO_READ_HERE :)

            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Key Usage:
                Digital Signature
    Signature Algorithm: sha1WithRSAEncryption



作为正常的服务器，以下扩展是不对的
X509v3 Extended Key Usage:
            TLS Web Client Authentication
        X509v3 Key Usage:
            Digital Signature
必须添加 extended key usage

TLS Web Server Authentication

和   key usage

 Key Encipherment
















	 Certificate Uses and Corresponding Key Usage Bits 


	

		

			

				

					Purpose of Certificate
				
				

					Required Key Usage Bit
				
			
		
		

			

				

					CA Signing
				
				

					

						

							

								

									keyCertSign
								
							
							

								

									cRLSign
								
							
						
					
				
			
			

				

					SSL Client
				
				

					digitalSignature
				
			
			

				

					SSL Server
				
				

					keyEncipherment
				
			
			

				

					S/MIME Signing
				
				

					digitalSignature
				
			
			

				

					S/MIME Encryption
				
				

					keyEncipherment
				
			
			

				

					Certificate Signing
				
				

					keyCertSign
				
			
			

				

					Object Signing
				
				

					digitalSignature
				
			
		
	


	PKIX Extended Key Usage Extension Uses 


	

		

			

				

					Use
				
				

					OID
				
			
		
		

			

				

					Server authentication
				
				

					1.3.6.1.5.5.7.3.1
				
			
			

				

					Client authentication
				
				

					1.3.6.1.5.5.7.3.2
				
			
			

				

					Code signing
				
				

					1.3.6.1.5.5.7.3.3
				
			
			

				

					Email
				
				

					1.3.6.1.5.5.7.3.4
				
			
			

				

					Timestamping
				
				

					1.3.6.1.5.5.7.3.8
				
			
			

				

					OCSP Signing
				
				

					

						1.3.6.1.5.5.7.3.9[a] 
					
				
			
		
		

			

				

					

						

							[a] OCSP Signing is not defined in PKIX Part 1, but in RFC 2560, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP.