diff --git a/ipapython/certdb.py b/ipapython/certdb.py
index 82b3869c4..4485f7367 100644
--- a/ipapython/certdb.py
+++ b/ipapython/certdb.py
@@ -569,7 +569,7 @@ class NSSDatabase(object):
         except cryptography.x509.ExtensionNotFound:
             raise ValueError("missing basic constraints")
 
-        if not bc.ca:
+        if not bc.value.ca:
             raise ValueError("not a CA certificate")
 
         try: