Issue:
After updating browser versions, users may encounter an ERR_SSL_KEY_USAGE_INCOMPATIBLE error when attempting to access the PME web application.

Product Line:
Power Monitoring Expert 8.2
Power Monitoring Expert 9.0
Power Monitoring Expert 2020
Power Monitoring Expert 2021
Power Monitoring Expert 2022
Power Monitoring Expert 2023

Environment:
PME Web Client

Cause:
The error occurred due to the recent update requiring a new security feature. The PME web app, which uses an SSL certificate, is missing a "Digital Signature" in its key usage parameters.

Resolution:

A PowerShell script is provided to correct the SSL certificate issue. Please follow these steps:

1. Backup Certificates: Before running the script, back up any existing self-signed certificates.

2. Run the Script: Execute the provided PowerShell script with administrative privileges. This script will create a new SSL certificate and ensure the "Digital Signature" is included in the key usage parameters.

• Right click on Powershell and select "run as administrator."
• In the Powershell window, use the "cd" command to navigate to the directory the script is stored in.
• Type .\SelfSignedCertGenerator.ps1 to execute the script.

3. Select New Certificate:In the Internet Information Services (IIS) manager, select the new certificate.

• In the left hand "connections" pane, select the PME site (usually default website).
• In the right-most "actions" pane, select the option "edit bindings."
• In the edit bindings window, select the row "443."
• Change the SSL certificate to "Local Self Signed 3."

4. Restart Services: After applying the script, you may need to restart relevant services for the changes to take effect:

• Run iisreset from the command line as an administrator.
• Restart any other associated services, like the ION Application Core Services.

Detailed Steps with Screenshots:

• The images provided show the difference between an SSL certificate with the "Digital Signature" parameter (Image 1) and one without it (Image 2). These can serve as a visual guide to verify the certificate status before and after applying the script.

Additional Note: If you encounter this issue with a CA-issued certificate, the CA will need to issue a new certificate that includes the "Digital Signature" key usage.

While using Edge, if you encounter the below error, enabling the site in Internet Explorer Mode will restore access to the web client. Please see FAQ000259421.
After enabling Internet Explorer mode, adding the webpage URL to trusted sites via Control Panel-> Internet Options -> Security is advised.

Released for:Schneider Electric Malaysia