diff --git a/cmd/kes/main.go b/cmd/kes/main.go
index 97fc5814..5dad645c 100644
--- a/cmd/kes/main.go
+++ b/cmd/kes/main.go
@@ -238,7 +238,9 @@ func newClient(conf config) *kes.Client {
 	}
 
 	client := kes.NewClientWithConfig("", &tls.Config{
-		Certificates:       []tls.Certificate{cert},
+		GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
+			return &cert, nil
+		},
 		InsecureSkipVerify: conf.InsecureSkipVerify,
 	})
 	client.Endpoints = endpoints