diff --git a/cluster/prodvider/main.go b/cluster/prodvider/main.go
index 7222a86..ca114f0 100644
--- a/cluster/prodvider/main.go
+++ b/cluster/prodvider/main.go
@@ -1,15 +1,16 @@
 package main
 
 import (
+	"crypto/ed25519"
+	"crypto/x509"
+	"encoding/pem"
 	"flag"
-	"io/ioutil"
+	"fmt"
 	"math/rand"
 	"net"
 	"os"
 	"time"
 
-	"github.com/cloudflare/cfssl/config"
-	"github.com/cloudflare/cfssl/signer/local"
 	"github.com/golang/glog"
 	"google.golang.org/grpc"
 	"k8s.io/client-go/kubernetes"
@@ -36,44 +37,66 @@
 }
 
 type prodvider struct {
-	sign      *local.Signer
-	k8s       *kubernetes.Clientset
-	srv       *grpc.Server
-	kubeCAPEM []byte
+	k8s *kubernetes.Clientset
+	srv *grpc.Server
+
+	intermediateCAKey  ed25519.PrivateKey
+	intermediateCACert *x509.Certificate
+	kubeCACert         *x509.Certificate
+}
+
+func loadCert(path string) (*x509.Certificate, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	block, _ := pem.Decode(b)
+	if block == nil {
+		return nil, fmt.Errorf("no PEM block found")
+	}
+	if block.Type != "CERTIFICATE" {
+		return nil, fmt.Errorf("unexpected PEM block: %q", block.Type)
+	}
+	return x509.ParseCertificate(block.Bytes)
+}
+
+func loadKey(path string) (ed25519.PrivateKey, error) {
+	bytes, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(bytes)
+	if block == nil {
+		return nil, fmt.Errorf("no PEM block found")
+	}
+	if block.Type != "PRIVATE KEY" {
+		return nil, fmt.Errorf("unexpected PEM block: %q", block.Type)
+	}
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, err
+	}
+	if k, ok := key.(ed25519.PrivateKey); ok {
+		return k, nil
+	}
+	return nil, fmt.Errorf("not an ED25519 key")
 }
 
 func newProdvider() *prodvider {
-	policy := &config.Signing{
-		Profiles: map[string]*config.SigningProfile{
-			"server": &config.SigningProfile{
-				Usage:        []string{"signing", "key encipherment", "server auth"},
-				ExpiryString: "30d",
-			},
-			"client": &config.SigningProfile{
-				Usage:        []string{"signing", "key encipherment", "client auth"},
-				ExpiryString: "30d",
-			},
-			"client-server": &config.SigningProfile{
-				Usage:        []string{"signing", "key encipherment", "server auth", "client auth"},
-				ExpiryString: "30d",
-			},
-		},
-		Default: config.DefaultConfig(),
-	}
-
-	sign, err := local.NewSignerFromFile(flagCACertificatePath, flagCAKeyPath, policy)
+	kubeCACert, err := loadCert(flagKubeCACertificatePath)
 	if err != nil {
-		glog.Exitf("Could not create signer: %v", err)
+		glog.Exitf("Loading kube CA certificate failed: %v", err)
 	}
-
-	kubeCAPEM, err := ioutil.ReadFile(flagKubeCACertificatePath)
+	intermediateCACert, err := loadCert(flagCACertificatePath)
 	if err != nil {
-		glog.Exitf("Could not read kube CA cert path: %v")
+		glog.Exitf("Loading intermediate CAcertificate failed: %v", err)
 	}
-
+	intermediateCAKey, err := loadKey(flagCAKeyPath)
 	return &prodvider{
-		sign:      sign,
-		kubeCAPEM: kubeCAPEM,
+		intermediateCAKey:  intermediateCAKey,
+		intermediateCACert: intermediateCACert,
+		kubeCACert:         kubeCACert,
 	}
 }