diff --git a/lib/puppet/provider/x509_cert/openssl.rb b/lib/puppet/provider/x509_cert/openssl.rb
index f5f9339..9aec8da 100644
--- a/lib/puppet/provider/x509_cert/openssl.rb
+++ b/lib/puppet/provider/x509_cert/openssl.rb
@@ -98,7 +98,7 @@ def create
       options += ['-passin', 'env:CERTIFICATE_PASSIN']
       env['CERTIFICATE_PASSIN'] = password
     end
-    options += ['-extensions', 'v3_req'] if resource[:req_ext] != :false
+    options += ['-extensions', 'v3_req'] if resource[:req_ext]
 
     # openssl(options) doesn't work because it's impossible to pass an env
     # https://github.com/puppetlabs/puppet/issues/9493