diff --git a/pkg/util/pki/csr_test.go b/pkg/util/pki/csr_test.go
index 78068ce5c..63dde2f85 100644
--- a/pkg/util/pki/csr_test.go
+++ b/pkg/util/pki/csr_test.go
@@ -45,17 +45,19 @@ func TestBuildUsages(t *testing.T) {
 	}
 	tests := []testT{
 		{
-			name:             "default",
-			usages:           []v1alpha2.KeyUsage{},
-			expectedKeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
-			expectedError:    false,
+			name:                "default",
+			usages:              []v1alpha2.KeyUsage{},
+			expectedKeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+			expectedExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			expectedError:       false,
 		},
 		{
-			name:             "isCa",
-			usages:           []v1alpha2.KeyUsage{},
-			isCa:             true,
-			expectedKeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign,
-			expectedError:    false,
+			name:                "isCa",
+			usages:              []v1alpha2.KeyUsage{},
+			isCa:                true,
+			expectedKeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign,
+			expectedExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+			expectedError:       false,
 		},
 		{
 			name:             "existing keyusage",