diff --git a/pkg/issuer/ca/issue.go b/pkg/issuer/ca/issue.go
index 105578bf1..1df8e0d2e 100644
--- a/pkg/issuer/ca/issue.go
+++ b/pkg/issuer/ca/issue.go
@@ -110,7 +110,7 @@ func createCertificateTemplate(publicKey interface{}, commonName string, altName
 		NotBefore: time.Now(),
 		NotAfter:  time.Now().Add(certificateDuration),
 		// see http://golang.org/pkg/crypto/x509/#KeyUsage
-		KeyUsage: x509.KeyUsageDigitalSignature,
+		KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
 		DNSNames: altNames,
 	}
 	return cert, nil