diff --git a/x509/bash.go b/x509/bash.go
index 6cb346d6..0c60fb2a 100644
--- a/x509/bash.go
+++ b/x509/bash.go
@@ -182,7 +182,7 @@ dns=$(openssl req -text -noout -verify -in $csr | grep DNS:)
 echo "signing with dns name: $dns" 1>&2
 
 cat >server.ext <<EOF
-keyUsage=critical, digitalSignature, keyEncipherment, keyAgreement
+keyUsage=critical, digitalSignature
 extendedKeyUsage=critical, serverAuth
 subjectAltName=$dns
 EOF
diff --git a/x509/common_test.go b/x509/common_test.go
index 47851e0c..a956f30d 100644
--- a/x509/common_test.go
+++ b/x509/common_test.go
@@ -112,7 +112,7 @@ func runTest(t *testing.T, verifyFiles func(factoryCa, tlsCert, onlineCa, offlin
 	assert.Equal(t, tlsCertChain, tlsCertChain1)
 
 	assert.Equal(t, false, tlsCert.IsCA)
-	assert.Equal(t, x509.KeyUsageDigitalSignature|x509.KeyUsageKeyEncipherment|x509.KeyUsageKeyAgreement, tlsCert.KeyUsage)
+	assert.Equal(t, x509.KeyUsageDigitalSignature, tlsCert.KeyUsage)
 	assert.Equal(t, testDnsBase, tlsCert.Subject.CommonName)
 	assert.Equal(t, []string{testDnsGateway, testDnsOstree}, tlsCert.DNSNames)
 	assert.Equal(t, [][]*x509.Certificate{{tlsCert, factoryCa}}, tlsCertChain)
@@ -129,7 +129,7 @@ func runTest(t *testing.T, verifyFiles func(factoryCa, tlsCert, onlineCa, offlin
 	assert.Nil(t, err)
 
 	assert.Equal(t, false, estCert.IsCA)
-	assert.Equal(t, x509.KeyUsageDigitalSignature|x509.KeyUsageKeyEncipherment|x509.KeyUsageKeyAgreement, estCert.KeyUsage)
+	assert.Equal(t, x509.KeyUsageDigitalSignature, estCert.KeyUsage)
 	assert.Equal(t, testDnsBase, estCert.Subject.CommonName)
 	assert.Equal(t, []string{testDnsEst}, estCert.DNSNames)
 	assert.Equal(t, [][]*x509.Certificate{{estCert, factoryCa}}, estCertChain)
diff --git a/x509/golang.go b/x509/golang.go
index 5483ef93..5ba8b16b 100644
--- a/x509/golang.go
+++ b/x509/golang.go
@@ -185,7 +185,7 @@ func genTlsCert(subject pkix.Name, dnsNames []string, pubkey crypto.PublicKey) s
 		NotAfter:     time.Now().AddDate(10, 0, 0),
 
 		IsCA:        false,
-		KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement,
+		KeyUsage:    x509.KeyUsageDigitalSignature,
 		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		DNSNames:    dnsNames,
 	}