diff --git a/.gitignore b/.gitignore
index 956c2477d..91fa83ba2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,5 @@
 .DS_Store
 .idea
-*.iml
 /acmesolver
 /controller
 /ingress-shim
diff --git a/pkg/util/pki/csr.go b/pkg/util/pki/csr.go
index 6751c046b..1eef77448 100644
--- a/pkg/util/pki/csr.go
+++ b/pkg/util/pki/csr.go
@@ -424,9 +424,9 @@ func SignCSRTemplate(caCerts []*x509.Certificate, caKey crypto.Signer, template
 		return nil, nil, errors.New("no CA certificates given to sign CSR template")
 	}
 
-	issuingCACert := caCerts[0]
+	caCert := caCerts[0]
 
-	certPem, _, err := SignCertificate(template, issuingCACert, template.PublicKey, caKey)
+	certPem, _, err := SignCertificate(template, caCert, template.PublicKey, caKey)
 	if err != nil {
 		return nil, nil, err
 
@@ -440,8 +440,7 @@ func SignCSRTemplate(caCerts []*x509.Certificate, caKey crypto.Signer, template
 	certPem = append(certPem, chainPem...)
 
 	// encode the CA certificate to be bundled in the output
-	caCert := caCerts[len(caCerts)-1]
-	caPem, err := EncodeX509(caCert)
+	caPem, err := EncodeX509(caCerts[0])
 	if err != nil {
 		return nil, nil, err
 	}