oven-sh/bun · error · TypeError

KEYUSAGE_NO_DIGITAL_SIGNATURE

KEYUSAGE_NO_DIGITAL_SIGNATURE

Error message

KEYUSAGE_NO_DIGITAL_SIGNATURE

What it means

CertError::KEYUSAGE_NO_DIGITAL_SIGNATURE maps BoringSSL X509 verify code 39 (X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE) via get_cert_error_from_no() in src/http/lib.rs:1558. The certificate's keyUsage lacks the digitalSignature bit, but the operation being validated (TLS purpose check) requires the key to sign (ECDHE/DHE key exchange signs the handshake with the cert key). JS error.code is KEYUSAGE_NO_DIGITAL_SIGNATURE with message 'key usage does not include digital signature' (FetchTasklet.rs:1490).

Source

Thrown at src/http/error.rs:199

    #[error("AKID_SKID_MISMATCH")]
    AKID_SKID_MISMATCH,
    #[error("AKID_ISSUER_SERIAL_MISMATCH")]
    AKID_ISSUER_SERIAL_MISMATCH,
    #[error("KEYUSAGE_NO_CERTSIGN")]
    KEYUSAGE_NO_CERTSIGN,
    #[error("UNABLE_TO_GET_CRL_ISSUER")]
    UNABLE_TO_GET_CRL_ISSUER,
    #[error("UNHANDLED_CRITICAL_EXTENSION")]
    UNHANDLED_CRITICAL_EXTENSION,
    #[error("KEYUSAGE_NO_CRL_SIGN")]
    KEYUSAGE_NO_CRL_SIGN,
    #[error("UNHANDLED_CRITICAL_CRL_EXTENSION")]
    UNHANDLED_CRITICAL_CRL_EXTENSION,
    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Inspect the leaf keyUsage: openssl x509 -in leaf.pem -noout -text | grep -A1 'Key Usage'
2. Reissue the certificate with keyUsage=critical,digitalSignature,keyEncipherment
3. Or restrict the server to static-RSA-compatible ciphers (not recommended: loses forward secrecy)
4. If an intermediate enforces the restriction, reissue beneath a CA without it

Example fix

# before
keyUsage=critical,keyEncipherment
# after
keyUsage=critical,digitalSignature,keyEncipherment
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key \
  -extfile <(printf 'keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth') -out server.pem -days 390

import { execSync } from "node:child_process";
const text = execSync("openssl x509 -in server.pem -noout -text").toString();
if (!/Digital Signature/.test(text)) {
  throw new Error("cert lacks digitalSignature — ECDHE/DHE handshakes will fail KEYUSAGE_NO_DIGITAL_SIGNATURE");
}

function isNoDigitalSignature(e: unknown): e is Error & { code: "KEYUSAGE_NO_DIGITAL_SIGNATURE" } {
  return e instanceof Error && (e as any).code === "KEYUSAGE_NO_DIGITAL_SIGNATURE";
}

try { await fetch(url); } catch (e) { if (isNoDigitalSignature(e)) { openCertTicket(new URL(url).host, "reissue with digitalSignature keyUsage"); throw e; } throw e; }

When it happens

Trigger: Server certificate issued with keyUsage=keyEncipherment only (RSA static key exchange profile) while the negotiated cipher suite is ECDHE_RSA/DHE_RSA, which requires the cert key to sign; client/proxy certs lacking digitalSignature where signing is required.

Common situations: Legacy enterprise cert profiles that set only keyEncipherment, modern servers defaulting to forward-secret cipher suites with an old cert, hardware-appliance certs from restrictive templates.

Related errors

• KEYUSAGE_NO_CERTSIGN
• KEYUSAGE_NO_CRL_SIGN
• UNABLE_TO_VERIFY_LEAF_SIGNATURE
• CERT_CHAIN_TOO_LONG
• INVALID_CA

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/7cf63b5fcfe24aa4. Report an issue: GitHub.