diff --git a/warden_ra/warden_apply.sh b/warden_ra/warden_apply.sh
index 18024c6711c654c8676f6bac45705527364084a8..2d8cafae96cf37484541f46161d18dbd290ecb61 100644
--- a/warden_ra/warden_apply.sh
+++ b/warden_ra/warden_apply.sh
@@ -41,6 +41,10 @@ openssl req -new -nodes -batch -keyout "$key" -out "$csr" -config "$config" || f
 if [ -z "$inkey" ]; then
     curl --progress-bar $cacert --request POST --data-binary '@-' "$url?name=$client&password=$password" < "$csr" > "$result"
 else
+    # local cert file name may be interpreted as a "nickname", add "./" to force interpretation as a file
+    if [[ ! "$incert" =~ "/" ]]; then
+        incert="./$incert"
+    fi
     curl --progress-bar $cacert --request POST --data-binary '@-' --cert "$incert" --key "$inkey" "$url?name=$client" < "$csr" > "$result"
 fi