diff --git a/ipapython/certdb.py b/ipapython/certdb.py
index fa6995d3d..8c5382191 100644
--- a/ipapython/certdb.py
+++ b/ipapython/certdb.py
@@ -716,6 +716,12 @@ class NSSDatabase(object):
         if not bc.value.ca:
             raise ValueError("not a CA certificate")
 
+        try:
+            cert.extensions.get_extension_for_class(
+                    cryptography.x509.SubjectKeyIdentifier)
+        except cryptography.x509.ExtensionNotFound:
+            raise ValueError("missing subject key identifier extension")
+
         try:
             self.run_certutil(['-V', '-n', nickname, '-u', 'L'],
                               capture_output=True)