diff --git a/charts/spire/README.md b/charts/spire/README.md
index aa78b54..7eba439 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -34,12 +34,10 @@ global:
     # Update these
     clusterName: example-cluster
     trustDomain: example.org
-spire-server:
-  ca_subject:
-    # Update these
-    country: ARPA
-    organization: Example
-    common_name: example.org
+    caSubject:
+      country: ARPA
+      organization: Example
+      commonName: example.org
 ```
 
 2. If you need a non default storageClass, append the following to the spire-server section and update:
@@ -214,6 +212,9 @@ Now you can interact with the Spire agent socket from your own application. The
 | `global.spire.jwtIssuer`                         | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset                                                                                                                                                      | `""`              |
 | `global.spire.trustDomain`                       | The trust domain for Spire install                                                                                                                                                                                                     | `example.org`     |
 | `global.spire.upstreamServerAddress`             | Set what address to use for the upstream server when using nested spire                                                                                                                                                                | `""`              |
+| `global.spire.caSubject.country`                 | Country for Spire server CA                                                                                                                                                                                                            | `""`              |
+| `global.spire.caSubject.organization`            | Organization for Spire server CA                                                                                                                                                                                                       | `""`              |
+| `global.spire.caSubject.commonName`              | Common Name for Spire server CA                                                                                                                                                                                                        | `""`              |
 | `global.spire.recommendations.enabled`           | Use recommended settings for production deployments. Default is off.                                                                                                                                                                   | `false`           |
 | `global.spire.recommendations.namespaceLayout`   | Set to true to use recommended values for installing across namespaces                                                                                                                                                                 | `true`            |
 | `global.spire.recommendations.namespacePSS`      | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels                                                                                                                                       | `true`            |
diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl
index d2ecb39..cd81b6a 100644
--- a/charts/spire/charts/spire-server/templates/_helpers.tpl
+++ b/charts/spire/charts/spire-server/templates/_helpers.tpl
@@ -264,3 +264,18 @@ The code below determines what connection type should be used.
 {{-     .Release.Namespace }}-{{ default .Release.Name .Values.crNameOverride }}
 {{-   end -}}
 {{- end -}}
+
+{{- define "spire-server.ca-subject-country" }}
+{{-   $g := dig "spire" "caSubject" "country" "" .Values.global }}
+{{-   default .Values.ca_subject.country $g }}
+{{- end }}
+
+{{- define "spire-server.ca-subject-organization" }}
+{{-   $g := dig "spire" "caSubject" "organization" "" .Values.global }}
+{{-   default .Values.ca_subject.organization $g }}
+{{- end }}
+
+{{- define "spire-server.ca-subject-common-name" }}
+{{-   $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
+{{-   default .Values.ca_subject.common_name $g }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 8e5ac70..d72d811 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -1,9 +1,9 @@
 {{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
 {{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
 {{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
-{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq .Values.ca_subject.country "ARPA"))}}
-{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
-{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
+{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
+{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
+{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
 {{- range $type, $tvals := .Values.customPlugins }}
 {{-   if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
 {{-     fail (printf "Unknown plugin type specified: %s" $type) }}
@@ -59,11 +59,9 @@ server:
   default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
 
   ca_subject:
-    {{- with .Values.ca_subject }}
-    - country: [{{ .country | quote }}]
-      organization: [{{ .organization | quote }}]
-      common_name: {{ .common_name | quote }}
-    {{- end }}
+    - country: [{{ include "spire-server.ca-subject-country" . | quote }}]
+      organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
+      common_name: {{ include "spire-server.ca-subject-common-name" . | quote }}
 
   {{- with .Values.federation }}
   {{- if eq (.enabled | toString) "true" }}
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index ff2deb2..e5de054 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -21,6 +21,14 @@ global:
     ## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
     upstreamServerAddress: ""
 
+    ## @param global.spire.caSubject.country Country for Spire server CA
+    ## @param global.spire.caSubject.organization Organization for Spire server CA
+    ## @param global.spire.caSubject.commonName Common Name for Spire server CA
+    caSubject:
+      country: ""
+      organization: ""
+      commonName: ""
+
     ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
     ## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
     ## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels