diff --git a/command/ca/provisioner/add.go b/command/ca/provisioner/add.go
index a6b081a7..4b5a7403 100644
--- a/command/ca/provisioner/add.go
+++ b/command/ca/provisioner/add.go
@@ -633,12 +633,6 @@ func createX5CDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
 	}
 	var rootBytes [][]byte
 	for _, r := range roots {
-		if r.KeyUsage&x509.KeyUsageCertSign == 0 {
-			return nil, errors.Errorf("error: certificate with common name '%s' cannot be "+
-				"used as an X5C root certificate.\n\n"+
-				"X5C provisioner root certificates must have the 'Certificate Sign' key "+
-				"usage extension.", r.Subject.CommonName)
-		}
 		rootBytes = append(rootBytes, pem.EncodeToMemory(&pem.Block{
 			Type:  "CERTIFICATE",
 			Bytes: r.Raw,
diff --git a/command/ca/provisioner/update.go b/command/ca/provisioner/update.go
index 98f6cabe..8281ae65 100644
--- a/command/ca/provisioner/update.go
+++ b/command/ca/provisioner/update.go
@@ -4,7 +4,6 @@ import (
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/rsa"
-	"crypto/x509"
 	"encoding/pem"
 	"fmt"
 	"net/url"
@@ -702,12 +701,6 @@ func updateX5CDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
 		}
 		var rootBytes [][]byte
 		for _, r := range roots {
-			if r.KeyUsage&x509.KeyUsageCertSign == 0 {
-				return errors.Errorf("error: certificate with common name '%s' cannot be "+
-					"used as an X5C root certificate.\n\n"+
-					"X5C provisioner root certificates must have the 'Certificate Sign' key "+
-					"usage extension.", r.Subject.CommonName)
-			}
 			rootBytes = append(rootBytes, pem.EncodeToMemory(&pem.Block{
 				Type:  "CERTIFICATE",
 				Bytes: r.Raw,