diff --git a/app/models/certificate.rb b/app/models/certificate.rb
index 8dabc1b5a..e51dda2eb 100644
--- a/app/models/certificate.rb
+++ b/app/models/certificate.rb
@@ -83,7 +83,7 @@ class Certificate < ApplicationRecord
     crt_file = Tempfile.new('client_crt')
     _out, err, _st = Open3.capture3('openssl', 'ca', '-config', ENV['openssl_config_path'],
                                     '-keyfile', ENV['ca_key_path'], '-cert', ENV['ca_cert_path'],
-                                    '-extensions', 'usr_cert', '-notext', '-md sha256',
+                                    '-extensions', 'usr_cert', '-notext', '-md', 'sha256',
                                     '-in', csr_file.path, '-out', crt_file.path, '-key', ENV['ca_key_password'],
                                     '-batch')
 
diff --git a/test/system/registrar_area/bulk_change/nameserver_test.rb b/test/system/registrar_area/bulk_change/nameserver_test.rb
index c4416f649..cfde8e6d1 100644
--- a/test/system/registrar_area/bulk_change/nameserver_test.rb
+++ b/test/system/registrar_area/bulk_change/nameserver_test.rb
@@ -3,7 +3,7 @@ require 'application_system_test_case'
 class RegistrarAreaNameserverBulkChangeTest < ApplicationSystemTestCase
   setup do
     sign_in users(:api_goodnames)
-    Capybara.default_max_wait_time = 5
+    Capybara.default_max_wait_time = 10
   end
 
   def test_replaces_current_registrar_nameservers