diff --git a/cmd/server/main.go b/cmd/server/main.go
index abb9181..2fd0caf 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -16,9 +16,9 @@ import (
 	"github.com/samosvalishe/btp/internal/proxy/bondserver"
 	"github.com/samosvalishe/btp/internal/proxy/tcpfwdserver"
 	"github.com/samosvalishe/btp/internal/proxy/udpserver"
+	"github.com/samosvalishe/btp/internal/transport/dtlsdial"
 	"github.com/samosvalishe/btp/internal/wire/srtpmimicry"
 	"github.com/pion/dtls/v3"
-	"github.com/pion/dtls/v3/pkg/crypto/selfsign"
 )
 
 func main() {
@@ -66,7 +66,7 @@ func main() {
 		logger.Warnf("running without -wrap: any client reaching %s can relay to %s (no shared-key auth)", cfg.Proxy.Listen, cfg.Proxy.Connect)
 	}
 
-	certificate, genErr := selfsign.GenerateSelfSigned()
+	certificate, genErr := dtlsdial.GenerateSelfSignedCert()
 	if genErr != nil {
 		logger.Errorf("self-signed cert: %v", genErr)
 		os.Exit(1)
diff --git a/internal/transport/dtlsdial/dtlsdial.go b/internal/transport/dtlsdial/dtlsdial.go
index 7bd7485..d00c9d3 100644
--- a/internal/transport/dtlsdial/dtlsdial.go
+++ b/internal/transport/dtlsdial/dtlsdial.go
@@ -14,6 +14,13 @@ import (
 	"github.com/pion/dtls/v3/pkg/crypto/selfsign"
 )
 
+// GenerateSelfSignedCert returns a new self-signed TLS certificate for use
+// as the DTLS identity. It is a thin wrapper around selfsign.GenerateSelfSigned
+// and exists so both cmd/server and Dialer share one call-site.
+func GenerateSelfSignedCert() (tls.Certificate, error) {
+	return selfsign.GenerateSelfSigned()
+}
+
 // Dialer configures the DTLS client handshake.
 type Dialer struct {
 	// HandshakeTimeout caps the handshake context. Zero means no timeout.