diff --git a/board/common/rootfs/etc/finit.d/available/mkcert.conf b/board/common/rootfs/etc/finit.d/available/mkcert.conf
index d2728616..2fc7d35b 100644
--- a/board/common/rootfs/etc/finit.d/available/mkcert.conf
+++ b/board/common/rootfs/etc/finit.d/available/mkcert.conf
@@ -1 +1 @@
-task [S] <service/confd/ready> mkcert -- Verifying self-signed https certificate
+task [S] <service/confd/ready> /libexec/infix/mkcert -- Verifying self-signed https certificate
diff --git a/board/common/rootfs/sbin/mkcert b/board/common/rootfs/libexec/infix/mkcert
similarity index 98%
rename from board/common/rootfs/sbin/mkcert
rename to board/common/rootfs/libexec/infix/mkcert
index ed108b1e..1bebec23 100755
--- a/board/common/rootfs/sbin/mkcert
+++ b/board/common/rootfs/libexec/infix/mkcert
@@ -30,7 +30,7 @@ generate()
 	    --out-certificate $CRT --out-key $KEY
 }
 
-CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN = //')
+CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN=//')
 if [ -z "$CN" ] || [ "$CN" != "$cn" ]; then
     generate "$cn"
 fi