diff --git a/tools/clustercfg.py b/tools/clustercfg.py
index a36664a..0426cee 100644
--- a/tools/clustercfg.py
+++ b/tools/clustercfg.py
@@ -221,7 +221,7 @@
             '-reqexts', 'SAN',
         ] if san else []))
 
-        pki.sign(local_csr, local_cert, local_config, days)
+        pki.sign(local_csr, local_cert, local_config if san else None, days)
         os.remove(local_csr)
         os.remove(local_config)
 
@@ -329,6 +329,7 @@
         modified |= shared_cert(p, c, fqdn, 'kube-{}'.format(component), Subject(o, ou, o))
     modified |= shared_cert(p, c, fqdn, 'kube-apiserver', Subject(Subject.hswaw, 'Kubernetes API', cluster), san=['IP:10.10.12.1', 'DNS:' + cluster])
     modified |= shared_cert(p, c, fqdn, 'kube-serviceaccounts', Subject(Subject.hswaw, 'Kubernetes Service Account Signer', 'service-accounts'))
+    modified |= shared_cert(p, c, fqdn, 'kube-calico', Subject(Subject.hswaw, 'Kubernetes Calico Account', 'calico'))
 
     c.run('nixos-rebuild switch')