diff --git a/Cargo.lock b/Cargo.lock
index 5ad442791a..b2ec1dbbf0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9006,6 +9006,7 @@ dependencies = [
  "rustix 0.38.37",
  "rustix 1.0.7",
  "rustls 0.23.19",
+ "rustls-pki-types",
  "rustls-webpki 0.102.8",
  "schemars 0.8.22",
  "scopeguard",
@@ -11299,12 +11300,13 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.12.1"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48406db8ac1f3cbc7dcdb56ec355343817958a356ff430259bb07baf7607e1e1"
+checksum = "5fae430c6b28f1ad601274e78b7dffa0546de0b73b4cd32f46723c0c2a16f7a5"
 dependencies = [
  "pem",
  "ring",
+ "rustls-pki-types",
  "time",
  "yasna",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 0aa02a2e81..2f655017a1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -666,7 +666,7 @@ range-requests = { path = "range-requests" }
 ratatui = "0.29.0"
 raw-cpuid = { git = "https://github.com/oxidecomputer/rust-cpuid.git", rev = "a4cf01df76f35430ff5d39dc2fe470bcb953503b" }
 rayon = "1.10"
-rcgen = "0.12.1"
+rcgen = "0.14.5"
 reconfigurator-cli = { path = "dev-tools/reconfigurator-cli" }
 reedline = "0.40.0"
 ref-cast = "1.0"
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index 5f6201a019..01031a91d6 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -114,6 +114,7 @@ reqwest = { version = "0.12.24", features = ["blocking", "cookies", "json", "rus
 rsa = { version = "0.9.8", features = ["serde", "sha2"] }
 rustc-hash = { version = "2.1.1" }
 rustls = { version = "0.23.19", features = ["ring"] }
+rustls-pki-types = { version = "1.10.0", features = ["std"] }
 rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.22", features = ["bytes", "chrono", "semver", "url", "uuid1"] }
 scopeguard = { version = "1.2.0" }
@@ -255,6 +256,7 @@ reqwest = { version = "0.12.24", features = ["blocking", "cookies", "json", "rus
 rsa = { version = "0.9.8", features = ["serde", "sha2"] }
 rustc-hash = { version = "2.1.1" }
 rustls = { version = "0.23.19", features = ["ring"] }
+rustls-pki-types = { version = "1.10.0", features = ["std"] }
 rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.22", features = ["bytes", "chrono", "semver", "url", "uuid1"] }
 scopeguard = { version = "1.2.0" }