title: Error: KeyUsage does not allow digital signatures - Java-applet + mutual SSL
body: <p>We have developed a webbased Java application running in Tomcat under IIS on Windows 2008. The website has 2-way (mutual) SSL enabled in IIS requiring the client to authenticate using a x.509 certificate (PKI) as part of SSL and this works fine with all our certificates using IE.</p>
  
  <p>The website also has a java-applet called ViewOne ImageViewer. This works fine with 2-way SSL with some of our certificates but with others we get the exception on the client (java 1.6) during SSL-handshake after the user has selected its authentication certificate:</p>
  
  <blockquote>
    <p>security: KeyUsage does not allow
    digital signatures</p>
  </blockquote>
  
  <p>The most obvious difference between the certificates are that EKU (Extended Key Usage) are not present on the certificates failing. The certificate working has the EKU "Client Authentication - 1.3.6.1.5.5.7.3.2".</p>
  
  <p>Does anyone know if the EKU 1.3.6.1.5.5.7.3.2 is needed to run a java applet or if this can be set somewhere?
  Or could the error be because of something else?</p>
  
  <p>Thanks!</p>