diff --git a/autoca/certutil.py b/autoca/certutil.py
index 73e17116c7e16763b8cb6a791e6f3498e5564825..cb8f472133ae91d1177df8a9a6be06367edd7836 100644
--- a/autoca/certutil.py
+++ b/autoca/certutil.py
@@ -44,7 +44,8 @@ def sign_certificate(req, ca_key, ca_crt, serial_num, days,
     cert.set_subject(req.get_subject())
     cert.set_pubkey(req.get_pubkey())
     if extensions:
-        cert.set_version(3)
+        # certificate version 3, not a typo
+        cert.set_version(2)
         cert.add_extensions(extensions)
     cert.sign(ca_key, digest)
     return cert