client certs should only have digitalSignature

diff --git a/lib/leap_cli/commands/ca.rb b/lib/leap_cli/commands/ca.rb
index 63749ca610ff4839de9ef84a65820b0354668cea..779fa307b1d9616ae32d25dea9359cfd07ebe207 100644 (file)
--- a/lib/leap_cli/commands/ca.rb
+++ b/lib/leap_cli/commands/ca.rb
@@ -337,7 +337,7 @@ module LeapCli; module Commands
       "digest" => "SHA256",
       "extensions" => {
         "keyUsage" => {
-          "usage" => ["digitalSignature", "keyEncipherment"]
+          "usage" => ["digitalSignature"]
         },
         "extendedKeyUsage" => {
           "usage" => ["clientAuth"]