diff --git a/cluster/prodvider/hspki.go b/cluster/prodvider/hspki.go
index 243a424..e747889 100644
--- a/cluster/prodvider/hspki.go
+++ b/cluster/prodvider/hspki.go
@@ -15,11 +15,13 @@
 	pb "code.hackerspace.pl/hscloud/cluster/prodvider/proto"
 )
 
+// hspkiSigner returns a cfssl signer (CA) for HSPKI, by loading the CA
+// cert/key from Kubernetes.
 func (p *prodvider) hspkiSigner() (*local.Signer, error) {
 	policy := &config.Signing{
 		Profiles: map[string]*config.SigningProfile{
-			"client": &config.SigningProfile{
-				Usage:        []string{"signing", "key encipherment", "client auth"},
+			"client-server": &config.SigningProfile{
+				Usage:        []string{"signing", "key encipherment", "server auth", "client auth"},
 				ExpiryString: "30d",
 			},
 		},
@@ -44,6 +46,8 @@
 	return local.NewSigner(priv, parsedCa, signer.DefaultSigAlgo(priv), policy)
 }
 
+// hspkiCreds returns a HSPKI certificate/key for an SSO user. The returned
+// certificate is valida for both server and client usage.
 func (p *prodvider) hspkiCreds(username string) (*pb.HSPKIKeys, error) {
 	principal := fmt.Sprintf("%s.sso.hswaw.net", username)
 
@@ -79,7 +83,7 @@
 	signReq := signer.SignRequest{
 		Hosts:    []string{},
 		Request:  string(csrPEM),
-		Profile:  "client",
+		Profile:  "client-server",
 		NotAfter: time.Now().Add(9 * time.Hour),
 	}