diff --git a/acme/acme.go b/acme/acme.go
index 9fbe72c..8257ffb 100644
--- a/acme/acme.go
+++ b/acme/acme.go
@@ -598,10 +598,14 @@ func (c *Client) TLSALPN01ChallengeCert(token, domain string, opt ...CertOption)
 		return tls.Certificate{}, err
 	}
 	shasum := sha256.Sum256([]byte(ka))
+	extValue, err := asn1.Marshal(shasum[:])
+	if err != nil {
+		return tls.Certificate{}, err
+	}
 	acmeExtension := pkix.Extension{
 		Id:       idPeACMEIdentifierV1,
 		Critical: true,
-		Value:    shasum[:],
+		Value:    extValue,
 	}
 
 	tmpl := defaultTLSChallengeCertTemplate()
diff --git a/acme/acme_test.go b/acme/acme_test.go
index aa6ecaf..ef1fe47 100644
--- a/acme/acme_test.go
+++ b/acme/acme_test.go
@@ -1166,7 +1166,7 @@ func TestTLSALPN01ChallengeCert(t *testing.T) {
 		token   = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
 		keyAuth = "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA." + testKeyECThumbprint
 		// echo -n <token.testKeyECThumbprint> | shasum -a 256
-		h      = "dbbd5eefe7b4d06eb9d1d9f5acb4c7cda27d320e4b30332f0b6cb441734ad7b0"
+		h      = "0420dbbd5eefe7b4d06eb9d1d9f5acb4c7cda27d320e4b30332f0b6cb441734ad7b0"
 		domain = "example.com"
 	)