diff --git a/Cargo.lock b/Cargo.lock
index 97eb3afab5..e92eff3f29 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1450,7 +1450,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
 dependencies = [
  "cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -3606,9 +3606,9 @@ checksum = "f60fcc7d6849342eff22c4350c8b9a989ee8ceabc4b481253e8946b9fe83d684"
 
 [[package]]
 name = "rcgen"
-version = "0.13.2"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
+checksum = "49bc8ffa8a832eb1d7c8000337f8b0d2f4f2f5ec3cf4ddc26f125e3ad2451824"
 dependencies = [
  "pem",
  "ring",
diff --git a/linkerd/meshtls/Cargo.toml b/linkerd/meshtls/Cargo.toml
index 722260261d..217f419e60 100644
--- a/linkerd/meshtls/Cargo.toml
+++ b/linkerd/meshtls/Cargo.toml
@@ -32,7 +32,7 @@ linkerd-tls = { path = "../tls" }
 [dev-dependencies]
 tokio = { version = "1", features = ["macros", "net", "rt-multi-thread"] }
 tracing = { workspace = true }
-rcgen = "0.13.2"
+rcgen = "0.14.2"
 
 linkerd-conditional = { path = "../conditional" }
 linkerd-proxy-transport = { path = "../proxy/transport" }
diff --git a/linkerd/meshtls/tests/util.rs b/linkerd/meshtls/tests/util.rs
index e2a650cec9..537177c369 100644
--- a/linkerd/meshtls/tests/util.rs
+++ b/linkerd/meshtls/tests/util.rs
@@ -18,7 +18,7 @@ use linkerd_stack::{
 };
 use linkerd_tls as tls;
 use linkerd_tls_test_util as test_util;
-use rcgen::{BasicConstraints, CertificateParams, IsCa, KeyPair, SanType};
+use rcgen::{BasicConstraints, CertificateParams, IsCa, Issuer, KeyPair, SanType};
 use std::str::FromStr;
 use std::{
     net::SocketAddr,
@@ -40,8 +40,9 @@ fn generate_cert_with_name(subject_alt_names: Vec<SanType>) -> (Vec<u8>, Vec<u8>
     let issuer_key = KeyPair::generate().unwrap();
     let mut params = CertificateParams::default();
     params.subject_alt_names = subject_alt_names;
+    let issuer = Issuer::from_params(&params, &root_key);
     let cert = params
-        .signed_by(&issuer_key, &root_cert, &root_key)
+        .signed_by(&issuer_key, &issuer)
         .expect("should generate cert");
 
     (
diff --git a/linkerd/meshtls/verifier/Cargo.toml b/linkerd/meshtls/verifier/Cargo.toml
index 759841e2ad..ba632b20ed 100644
--- a/linkerd/meshtls/verifier/Cargo.toml
+++ b/linkerd/meshtls/verifier/Cargo.toml
@@ -15,4 +15,4 @@ linkerd-identity = { path = "../../identity" }
 
 
 [dev-dependencies]
-rcgen = "0.13.2"
+rcgen = "0.14.2"
diff --git a/linkerd/proxy/spire-client/Cargo.toml b/linkerd/proxy/spire-client/Cargo.toml
index e2e4d886a8..250ddbf319 100644
--- a/linkerd/proxy/spire-client/Cargo.toml
+++ b/linkerd/proxy/spire-client/Cargo.toml
@@ -24,5 +24,5 @@ asn1 = { version = "0.6", package = "simple_asn1" }
 thiserror = "2"
 
 [dev-dependencies]
-rcgen = "0.13.2"
+rcgen = "0.14.2"
 tokio-test = "0.4"