diff --git a/app/models/certificate.rb b/app/models/certificate.rb
index 8dabc1b5a..e51dda2eb 100644
--- a/app/models/certificate.rb
+++ b/app/models/certificate.rb
@@ -83,7 +83,7 @@ class Certificate < ApplicationRecord
     crt_file = Tempfile.new('client_crt')
     _out, err, _st = Open3.capture3('openssl', 'ca', '-config', ENV['openssl_config_path'],
                                     '-keyfile', ENV['ca_key_path'], '-cert', ENV['ca_cert_path'],
-                                    '-extensions', 'usr_cert', '-notext', '-md sha256',
+                                    '-extensions', 'usr_cert', '-notext', '-md', 'sha256',
                                     '-in', csr_file.path, '-out', crt_file.path, '-key', ENV['ca_key_password'],
                                     '-batch')