diff --git a/lab-2-simple-pki/README.md b/lab-2-simple-pki/README.md
index f5e0a13..f50aefc 100644
--- a/lab-2-simple-pki/README.md
+++ b/lab-2-simple-pki/README.md
@@ -244,7 +244,7 @@ openssl ca \
     -extensions signing_ca_ext
 ```
 
-Note that we are creating a new CSR using the same private key as before. This is crucial, as it was this private key that was used to sign our server's TLS certificate. With the second `openssl` command, we use a new configuration file for a Root CA owned by PartnerOrg, rather than ControlPlane (which has owned our previous CAs) to sign the CSR and produce a new certificate for ControlPlane's Signing CA 1. Crucially, this certificate has the same public key as before, but is signed by PartnerOrg's Root CA 2 private key. Note the `match_pol` in `config/root-ca-2.conf` no longer requires a match for `domainComponent` and `organizationName` for the certificates it signs, so signing a certficiate issued by another organization is possible. After cross signing, we can build an alternative certificate chain and again, curl the server to observe that a TLS connection is established:
+Note that we are creating a new CSR using the same private key as before. This is crucial, as it was this private key that was used to sign our server's TLS certificate. With the second `openssl` command, we use a new configuration file for a Root CA owned by PartnerOrg, rather than ControlPlane (which has owned our previous CAs) to sign the CSR and produce a new certificate for ControlPlane's Signing CA 1. Crucially, this certificate has the same public key as before, but is signed by PartnerOrg's Root CA 2 private key. Note the `match_pol` in `config/root-ca-2.conf` no longer requires a match for `domainComponent` and `organizationName` for the certificates it signs, so signing a certificate issued by another organization is possible. After cross signing, we can build an alternative certificate chain and again, curl the server to observe that a TLS connection is established:
 
 ```bash
 cat certs/control-plane.example.crt | openssl x509 > control-plane.example.pem