diff --git a/cert/selfsigned.go b/cert/selfsigned.go
index f67e8cd8..244d64b7 100644
--- a/cert/selfsigned.go
+++ b/cert/selfsigned.go
@@ -228,6 +228,7 @@ func GenCertPair(org, certFile, keyFile string, tlsExtraIPs,
 
 		KeyUsage: x509.KeyUsageKeyEncipherment |
 			x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		IsCA:                  true, // so can sign self.
 		BasicConstraintsValid: true,