The SSL server's RSA private key must be imported with the...

net/socket/ssl_server_socket_nss.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_server_socket_nss.h"
 
 #if defined(OS_WIN)
 #include <winsock2.h>
 #endif
 
@@ skipping 331 matching lines @@
   PK11SlotInfo *slot = base::GetDefaultNSSKeySlot();
   if (!slot) {
     CERT_DestroyCertificate(cert);
     return ERR_UNEXPECTED;
   }
 
   SECItem der_private_key_info;
   der_private_key_info.data =
       const_cast<unsigned char*>(&key_vector.front());
   der_private_key_info.len = key_vector.size();
+  // The server's RSA private key must be imported into NSS with the
+  // following key usage bits:
+  // - KU_KEY_ENCIPHERMENT, required for the RSA key exchange algorithm.
+  // - KU_DIGITAL_SIGNATURE, required for the DHE_RSA and ECDHE_RSA key
+  //   exchange algorithms.
+  const unsigned int key_usage = KU_KEY_ENCIPHERMENT | KU_DIGITAL_SIGNATURE;
   rv =  PK11_ImportDERPrivateKeyInfoAndReturnKey(
       slot, &der_private_key_info, NULL, NULL, PR_FALSE, PR_FALSE,
-      KU_DIGITAL_SIGNATURE, &private_key, NULL);
+      key_usage, &private_key, NULL);
   PK11_FreeSlot(slot);
   if (rv != SECSuccess) {
     CERT_DestroyCertificate(cert);
     return ERR_UNEXPECTED;
   }
 
   // Assign server certificate and private key.
   SSLKEAType cert_kea = NSS_FindCertKEAType(cert);
   rv = SSL_ConfigSecureServer(nss_fd_, cert, private_key, cert_kea);
   CERT_DestroyCertificate(cert);
@@ skipping 303 matching lines @@
                  << ", net_error " << net_error;
       net_log_.AddEvent(
           NetLog::TYPE_SSL_HANDSHAKE_ERROR,
           make_scoped_refptr(new SSLErrorParams(net_error, prerr)));
     }
   }
   return net_error;
 }
 
 }  // namespace net