diff --git a/serving/dot1x-bench/step-ca/bootstrap.sh b/serving/dot1x-bench/step-ca/bootstrap.sh
index 0123036..0fc1a6f 100755
--- a/serving/dot1x-bench/step-ca/bootstrap.sh
+++ b/serving/dot1x-bench/step-ca/bootstrap.sh
@@ -17,7 +17,14 @@ cd "$(dirname "$0")/.."
 [ -f .env ] && . ./.env
 CA_DNS=${CA_DNS:-ca.fleet.lab}
 CA_PORT=${CA_PORT:-8443}
-CA_URL="https://${CA_DNS}:${CA_PORT}"
+# The CLI must reach the CA over a name that RESOLVES on the serving host AND is
+# in the CA cert's SAN. ca.fleet.lab is only served by the fleet dnsmasq to
+# booting clients — the serving host itself can't resolve it — so default to
+# 'localhost' (the compose adds it to DOCKER_STEPCA_INIT_DNS_NAMES). CA_DNS stays
+# the cert/SAN name (and the RADIUS cert CN). Override CA_CONNECT if the CA is
+# remote/reachable by another resolvable SAN.
+CA_CONNECT=${CA_CONNECT:-localhost}
+CA_URL="https://${CA_CONNECT}:${CA_PORT}"
 PKI=pki
 
 # step-ca initialises its state into ./pki/stepca as uid 1000, but Docker created