diff --git a/pkg/certs/ca.go b/pkg/certs/ca.go
index d394c885..b1486a01 100644
--- a/pkg/certs/ca.go
+++ b/pkg/certs/ca.go
@@ -129,7 +129,7 @@ func (m *Manager) signCertificate(host string) (*tls.Certificate, error) {
 		},
 		NotBefore:             notBefore,
 		NotAfter:              notAfter,
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
 		BasicConstraintsValid: true,
 	}