diff --git a/axiom/plugins/mantissacmd.py b/axiom/plugins/mantissacmd.py
index <HASH>..<HASH> 100644
--- a/axiom/plugins/mantissacmd.py
+++ b/axiom/plugins/mantissacmd.py
@@ -18,7 +18,7 @@ from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
-from cryptography.x509.oid import NameOID
+from cryptography.x509.oid import NameOID, ExtendedKeyUsageOID
 
 from xmantissa.ixmantissa import IOfferingTechnician
 from xmantissa import webadmin, publicweb, stats
@@ -146,6 +146,20 @@ class Mantissa(axiomatic.AxiomaticCommand):
             .add_extension(
                 x509.BasicConstraints(ca=False, path_length=None),
                 critical=True)
+            .add_extension(
+                x509.KeyUsage(
+                    digital_signature=True,
+                    content_commitment=False,
+                    key_encipherment=True,
+                    data_encipherment=False,
+                    key_agreement=False,
+                    key_cert_sign=False,
+                    crl_sign=False,
+                    encipher_only=False,
+                    decipher_only=False))
+            .add_extension(
+                x509.ExtendedKeyUsage([
+                    ExtendedKeyUsageOID.SERVER_AUTH]))
             .sign(
                 private_key=privateKey,
                 algorithm=hashes.SHA256(),
Add KU and EKU extensions.