diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 4963bfc..ef36800 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -897,16 +897,18 @@ Missing key expected at: $key_in"
 		fi
 
 		# export the p12:
+		# shellcheck disable=SC2086
 		"$EASYRSA_OPENSSL" pkcs12 -in "$crt_in" -inkey "$key_in" -export \
-			-out "$pkcs_out" "$pkcs_opts" || die "\
+			-out "$pkcs_out" $pkcs_opts || die "\
 Export of p12 failed: see above for related openssl errors."
 	;;
 	p7)
 		pkcs_out="$EASYRSA_PKI/issued/$short_name.p7b"
 
 		# export the p7:
+		# shellcheck disable=SC2086
 		"$EASYRSA_OPENSSL" crl2pkcs7 -nocrl -certfile "$crt_in" \
-			-out "$pkcs_out" "$pkcs_opts" || die "\
+			-out "$pkcs_out" $pkcs_opts || die "\
 Export of p7 failed: see above for related openssl errors."
 	;;
 esac