diff --git a/tools/tpm2_pkcs11/commandlets_keys.py b/tools/tpm2_pkcs11/commandlets_keys.py
index 2d1acf52..d9b6c4b9 100644
--- a/tools/tpm2_pkcs11/commandlets_keys.py
+++ b/tools/tpm2_pkcs11/commandlets_keys.py
@@ -523,7 +523,7 @@ def __call__(self, args):
 
         # rather than use pycryptography x509 parser, which gives native type access to certficiate
         # fields use pyASN1 to get raw ASN1 encoded values for the fields as the spec requires them
-        with open(certpath, "rb") as f:
+        with open(certpath, "r") as f:
             substrate = pem.readPemFromFile(f)
             cert = decoder.decode(substrate, asn1Spec=rfc2459.Certificate())[0]