diff --git a/central_backend/src/crypto/pki.rs b/central_backend/src/crypto/pki.rs
index 39f5a34..70f8ec4 100644
--- a/central_backend/src/crypto/pki.rs
+++ b/central_backend/src/crypto/pki.rs
@@ -161,9 +161,11 @@ fn gen_certificate(req: GenCertificateReq) -> anyhow::Result<(Vec<u8>, Vec<u8>)>
     }
 
     // If cert is a CA or not
+    let mut basic = BasicConstraints::new();
     if req.ca {
-        cert_builder.append_extension(BasicConstraints::new().critical().ca().build()?)?;
+        basic.ca();
     }
+    cert_builder.append_extension(basic.critical().build()?)?;
 
     // Key usage
     let mut key_usage = KeyUsage::new();