diff --git a/pkg/internal/testing/integration/apiserver.go b/pkg/internal/testing/integration/apiserver.go
index 119657875e..4f0a4377c8 100644
--- a/pkg/internal/testing/integration/apiserver.go
+++ b/pkg/internal/testing/integration/apiserver.go
@@ -150,6 +150,9 @@ func (s *APIServer) populateAPIServerCerts() error {
 		return err
 	}
 
+	if err := ioutil.WriteFile(filepath.Join(s.CertDir, "apiserver-ca.crt"), ca.CA.CertBytes(), 0640); err != nil {
+		return err
+	}
 	if err := ioutil.WriteFile(filepath.Join(s.CertDir, "apiserver.crt"), certData, 0640); err != nil {
 		return err
 	}
diff --git a/pkg/internal/testing/integration/internal/tinyca.go b/pkg/internal/testing/integration/internal/tinyca.go
index 42991887f7..93161aed20 100644
--- a/pkg/internal/testing/integration/internal/tinyca.go
+++ b/pkg/internal/testing/integration/internal/tinyca.go
@@ -154,7 +154,7 @@ func (c *TinyCA) NewServingCert(names ...string) (CertPair, error) {
 			DNSNames: dnsNames,
 			IPs:      ips,
 		},
-		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 	})
 }