diff --git a/src/txkube/test/test_authentication.py b/src/txkube/test/test_authentication.py
index <HASH>..<HASH> 100644
--- a/src/txkube/test/test_authentication.py
+++ b/src/txkube/test/test_authentication.py
@@ -351,11 +351,11 @@ class ChainTests(TestCase):
                     BasicConstraints(True, None),
                     critical=True,
                 )
-            return builder.public_key(a_key.public_key(),
+            return builder.public_key(pubkey,
             ).serial_number(1,
             ).not_valid_before(datetime.utcnow(),
             ).not_valid_after(datetime.utcnow() + timedelta(seconds=1),
-            ).sign(a_key, SHA256(), default_backend(),
+            ).sign(privkey, SHA256(), default_backend(),
             )
 
         a_cert = cert(u"a.invalid", u"a.invalid", a_key.public_key(), a_key, True)
Ensure generated certificates use provided key arguments.

The cert function takes as parameters a public key to include in the
cert, and a private key to sign the cert.  Currently, both are always the
root key, which deviates from the arguments supplied to cert later in
the test.

Discussed on twisted-web:
<URL>