Failed to verify certificate: x509: certificate specifies an incompatible key usage

Consul
2

Hi @zappee,

If you look at the Extended Key Usage of your server certificate, you will see that it only has "TLS Web Server Authentication". Your certificate should have "TLS Web Server Authentication" and “TLS Web Client Authentication” in the Extended Key Usage.

       X509v3 Extended Key Usage: 
           TLS Web Server Authentication

Since every agent acts as a server and client, and when configured to do mTLS (using verify_incoming and verify_outgoing), server and client authentication constraints should be there or left empty.

You can compare this with a cert generated using the consul tls CLI.

X509v3 Extended Key Usage:
    TLS Web Server Authentication, TLS Web Client Authentication

I hope this helps!