diff --git a/cmd/dkl-local-server/tls-ca.go b/cmd/dkl-local-server/tls-ca.go
index 21e647a..5f7d43f 100644
--- a/cmd/dkl-local-server/tls-ca.go
+++ b/cmd/dkl-local-server/tls-ca.go
@@ -148,7 +148,7 @@ func getUsableKeyCert(cluster, caName, name, profile, label string, req *csr.Cer
 					return
 				}
 
-				_, err = cert.Verify(x509.VerifyOptions{Roots: pool})
+				_, err = cert.Verify(x509.VerifyOptions{Roots: pool, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}})
 				return
 			}()
 			if err == nil {