diff --git a/doc/CertificateAuthorityWithNEO.txt b/doc/CertificateAuthorityWithNEO.txt
index b154944..b418340 100644
--- a/doc/CertificateAuthorityWithNEO.txt
+++ b/doc/CertificateAuthorityWithNEO.txt
@@ -191,6 +191,8 @@ Then generate a new private key and certificate request:
 Then sign the certificate using the NEO:
 
   cat>yubico-internal-https-ee-$host-crt.conf<<EOF
+  keyUsage=critical,digitalSignature,keyEncipherment
+  extendedKeyUsage=critical,serverAuth
   EOF
   openssl << EOF
   engine dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre NO_VCHECK:1 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -pre VERBOSE