diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog
index 33f0e4b..a3e5689 100644
--- a/debian-package/debian/changelog
+++ b/debian-package/debian/changelog
@@ -1,3 +1,13 @@
+vpn-router (0.21.4-1) unstable; urgency=medium
+
+  fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the directory each as itself, instead of failing on a CA with a CRL.
+
+  * A CA's CRL was read as its key and its key as its CRL, so every
+    operation on a CA with a CRL failed with "Could not deserialize key
+    data".
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 10:00:00 +0100
+
 vpn-router (0.21.3-1) unstable; urgency=medium
 
   fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.
diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
index 9e01d4d..4bbcd30 100644
--- a/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
+++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
@@ -229,7 +229,7 @@ def authority(connection, name):
         attributes = connection.search_s(authority_dn(name), ldap.SCOPE_BASE, attrlist=AUTHORITY_ATTRIBUTES)[0][1]
     except ldap.NO_SUCH_OBJECT:
         return None
-    cert, key, crl = (first(attributes, item) for item in AUTHORITY_ATTRIBUTES[:3])
+    cert, crl, key = (first(attributes, item) for item in AUTHORITY_ATTRIBUTES[:3])
     return {
         'name': name,
         'cert': x509.load_der_x509_certificate(cert) if cert else None,