diff --git a/cmd/dkl-local-server/cluster-render-context.go b/cmd/dkl-local-server/cluster-render-context.go
index 2f6cceb..6be95ab 100644
--- a/cmd/dkl-local-server/cluster-render-context.go
+++ b/cmd/dkl-local-server/cluster-render-context.go
@@ -112,6 +112,16 @@ func templateFuncs(sslCfg *cfsslconfig.Config) map[string]any {
 		},
 
 		"ca_crt": func(cluster, name string) (s string, err error) {
+			ca, err := getCurrentClusterCA(cluster, name)
+			if err != nil {
+				return
+			}
+
+			s = string(ca.Cert)
+			return
+		},
+
+		"ca_crt_all": func(cluster, name string) (s string, err error) {
 			ca, err := getUsableClusterCA(cluster, name)
 			if err != nil {
 				return
diff --git a/cmd/dkl-local-server/ws-cluster-cas.go b/cmd/dkl-local-server/ws-cluster-cas.go
index 361e203..723abf7 100644
--- a/cmd/dkl-local-server/ws-cluster-cas.go
+++ b/cmd/dkl-local-server/ws-cluster-cas.go
@@ -87,6 +87,21 @@ func getUsableClusterCA(cluster, name string) (ca CA, err error) {
 	return
 }
 
+func getCurrentClusterCA(cluster, name string) (ca CA, err error) {
+	ca, err = getUsableClusterCA(cluster, name)
+	if err != nil {
+		return
+	}
+
+	certs, err := helpers.ParseCertificatesPEM(ca.Cert)
+	if err != nil {
+		return
+	}
+
+	ca.Cert = helpers.EncodeCertificatePEM(certs[0])
+	return
+}
+
 func caExtraCerts(cluster, name string) (extra string, err error) {
 	cfg, err := readConfig()
 	if err != nil {