diff --git a/metropolis/pkg/pki/ca.go b/metropolis/pkg/pki/ca.go
index 29d1335..b8c2aed 100644
--- a/metropolis/pkg/pki/ca.go
+++ b/metropolis/pkg/pki/ca.go
@@ -67,7 +67,7 @@
 	// Set the AuthorityKeyID to the SKID of the signing certificate (or self,
 	// if self-signing).
 	if ca != nil {
-		req.Template.AuthorityKeyId = ca.AuthorityKeyId
+		req.Template.AuthorityKeyId = ca.SubjectKeyId
 	} else {
 		req.Template.AuthorityKeyId = req.Template.SubjectKeyId
 		ca = &req.Template