diff --git a/breezy/tests/ssl_certs/create_ssls.py b/breezy/tests/ssl_certs/create_ssls.py
index 4a1dd4b432..3bab367479 100755
--- a/breezy/tests/ssl_certs/create_ssls.py
+++ b/breezy/tests/ssl_certs/create_ssls.py
@@ -131,6 +131,8 @@ def build_ca_certificate():
     _openssl(
         [
             "req",
+            "-addext",
+            "keyUsage = keyCertSign",
             "-passin",
             "stdin",
             "-new",