diff --git a/handshake_server.go b/handshake_server.go
index 76adc54..e5049a2 100644
--- a/handshake_server.go
+++ b/handshake_server.go
@@ -211,6 +211,7 @@ FindCipherSuite:
 				Roots:         c.config.ClientCAs,
 				CurrentTime:   c.config.time(),
 				Intermediates: x509.NewCertPool(),
+				KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 			}
 
 			for i, cert := range certs {