diff --git a/packages/apps/redis/templates/certmanager.yaml b/packages/apps/redis/templates/certmanager.yaml
index d7c7d7e82..6d104e667 100644
--- a/packages/apps/redis/templates/certmanager.yaml
+++ b/packages/apps/redis/templates/certmanager.yaml
@@ -69,6 +69,7 @@ spec:
   renewBefore: 720h
   isCA: false
   usages:
+    - digital signature
     - server auth
     - client auth
     - key encipherment
diff --git a/packages/apps/redis/tests/tls_test.yaml b/packages/apps/redis/tests/tls_test.yaml
index 56093277a..c82dab29e 100644
--- a/packages/apps/redis/tests/tls_test.yaml
+++ b/packages/apps/redis/tests/tls_test.yaml
@@ -125,6 +125,9 @@ tests:
       - equal:
           path: spec.privateKey.algorithm
           value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
 
   - it: "third document is the CA Issuer when TLS enabled via external"
     templates:
@@ -175,6 +178,26 @@ tests:
           path: spec.privateKey.algorithm
           value: ECDSA
 
+  - it: "leaf Certificate usages include digital signature for ECDSA TLS handshake"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      external: true
+    documentIndex: 3
+    asserts:
+      - contains:
+          path: spec.usages
+          content: "digital signature"
+      - contains:
+          path: spec.usages
+          content: "server auth"
+      - contains:
+          path: spec.usages
+          content: "client auth"
+      - contains:
+          path: spec.usages
+          content: "key encipherment"
+
   - it: "leaf Certificate SAN list covers all four redis-operator service names with all DNS variants"
     templates:
       - templates/certmanager.yaml