diff --git a/lib/hx509/hxtool.c b/lib/hx509/hxtool.c
index 9d010aab8..f6efe6717 100644
--- a/lib/hx509/hxtool.c
+++ b/lib/hx509/hxtool.c
@@ -1368,6 +1368,10 @@ hxtool_ca(struct certificate_sign_options *opt, int argc, char **argv)
 	ret = _hx509_private_key2SPKI(context, private_key, &spki);
 	if (ret)
 	    errx(1, "_hx509_private_key2SPKI: %d\n", ret);
+
+	if (opt->self_signed_flag)
+	    cert_key = private_key;
+
     }
 
     if (opt->req_string) {