diff --git a/salt/states/rancher/certs.sls b/salt/states/rancher/certs.sls
index 5bea15a..9ce399c 100644
--- a/salt/states/rancher/certs.sls
+++ b/salt/states/rancher/certs.sls
@@ -58,7 +58,7 @@ Set permission on rancher-server singing request:
 
 Create the rancher-server certificate:
   cmd.run:
-    - name: openssl x509 -req -in rancher-server.csr -CA rancher-ca.crt -CAkey rancher-ca.key -CAcreateserial --extfile rancher-server.cnf -extensions v3_req -out rancher-server.crt -days 3650 -sha256 -passin pass:{{ pillar['rancher']['ca_passphrase'] }}
+    - name: openssl x509 -req -in rancher-server.csr -CA rancher-ca.crt -CAkey rancher-ca.key -CAcreateserial -extfile rancher-server.cnf -extensions v3_req -out rancher-server.crt -days 3650 -sha256 -passin pass:{{ pillar['rancher']['ca_passphrase'] }}
     - cwd: /etc/rancher/ssl
     - onchanges:
       - cmd: Create the rancher-server signing request
diff --git a/salt/states/rmt/certs.sls b/salt/states/rmt/certs.sls
index fbfe3b0..39c29bd 100644
--- a/salt/states/rmt/certs.sls
+++ b/salt/states/rmt/certs.sls
@@ -65,7 +65,7 @@ Set permission on rmt-server singing request:
 
 Create the rmt-server certificate:
   cmd.run:
-    - name: openssl x509 -req -in rmt-server.csr -CA rmt-ca.crt -CAkey rmt-ca.key -CAcreateserial -out rmt-server.crt -days 3650 -sha256 -passin pass:{{ pillar['rmt']['ca_passphrase'] }}
+    - name: openssl x509 -req -in rmt-server.csr -CA rmt-ca.crt -CAkey rmt-ca.key -CAcreateserial -extfile rancher-server.cnf -extensions v3_req -out rmt-server.crt -days 3650 -sha256 -passin pass:{{ pillar['rmt']['ca_passphrase'] }}
     - cwd: /etc/rmt/ssl
     - onchanges:
       - cmd: Create the rmt-server signing request