diff --git a/certificate-authentication.md b/certificate-authentication.md
index 4563ee0a6c2d9..875451e8c3996 100644
--- a/certificate-authentication.md
+++ b/certificate-authentication.md
@@ -285,7 +285,7 @@ The user certificate information can be specified by `require subject`, `require
         {{< copyable "shell-regular" >}}
 
         ```shell
-        openssl x509 -noout -ext subjectAltName -in client.crt
+        openssl x509 -noout -extensions subjectAltName -in client.crt
         ```
 
     + `require san` currently supports the following `Subject Alternative Name` check items: