diff --git a/muted-tests.yml b/muted-tests.yml
index ac8c19d7feabe..5b30b4a97397a 100644
--- a/muted-tests.yml
+++ b/muted-tests.yml
@@ -256,9 +256,6 @@ tests:
 - class: org.elasticsearch.xpack.esql.expression.function.scalar.convert.ParseIpTests
   method: testLeadingZerosAreOctal {TestCase[str=v4, validLeadingZerosRejected=true, validLeadingZerosAreDecimal=true, validLeadingZerosAreOctal=true]}
   issue: https://github.com/elastic/elasticsearch/issues/126496
-- class: org.elasticsearch.xpack.security.cli.HttpCertificateCommandTests
-  method: testGenerateMultipleCertificateWithNewCA
-  issue: https://github.com/elastic/elasticsearch/issues/126471
 
 # Examples:
 #
diff --git a/x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java b/x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
index 792796fea8c35..57ad76af3317a 100644
--- a/x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
+++ b/x-pack/plugin/security/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java
@@ -380,7 +380,7 @@ public void testGenerateMultipleCertificateWithNewCA() throws Exception {
             caDN = "CN=" + randomAlphaOfLengthBetween(3, 8);
             caYears = randomIntBetween(1, 3);
             caKeySize = randomFrom(2048, 3072, 4096);
-            caKeyUsage = randomSubsetOf(CertGenUtils.KEY_USAGE_MAPPINGS.keySet());
+            caKeyUsage = randomNonEmptySubsetOf(CertGenUtils.KEY_USAGE_MAPPINGS.keySet());
             terminal.addTextInput(caDN);
             terminal.addTextInput(caYears + "y");
             terminal.addTextInput(Integer.toString(caKeySize));