diff --git a/pkg/kubectl/cmd/certificates.go b/pkg/kubectl/cmd/certificates.go
index 36c0ff6935..d45d83958e 100644
--- a/pkg/kubectl/cmd/certificates.go
+++ b/pkg/kubectl/cmd/certificates.go
@@ -200,7 +200,7 @@ func (o *CertificateOptions) RunCertificateDeny(force bool) error {
 		csr.Status.Conditions = append(csr.Status.Conditions, certificates.CertificateSigningRequestCondition{
 			Type:           certificates.CertificateDenied,
 			Reason:         "KubectlDeny",
-			Message:        "This CSR was approved by kubectl certificate deny.",
+			Message:        "This CSR was denied by kubectl certificate deny.",
 			LastUpdateTime: metav1.Now(),
 		})
 		return csr, false