diff --git a/pkg/tlsconfig/options.go b/pkg/tlsconfig/options.go
index 2598787e..4d73f593 100644
--- a/pkg/tlsconfig/options.go
+++ b/pkg/tlsconfig/options.go
@@ -48,7 +48,7 @@ func GRPCServerConfig(keypairs *pki.Keypairs, myPeerID string) (*tls.Config, err
 
 	config := certutil.Config{
 		CommonName: "etcd-manager-server-" + myPeerID,
-		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		Usages:     []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 	}
 
 	keypair, err := keypairs.EnsureKeypair("etcd-manager-server-"+myPeerID, config, ca)