diff --git a/OpenKeychain-Test/src/test/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperationTest.java b/OpenKeychain-Test/src/test/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperationTest.java
index 54ccccc3d..056165e01 100644
--- a/OpenKeychain-Test/src/test/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperationTest.java
+++ b/OpenKeychain-Test/src/test/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperationTest.java
@@ -99,6 +99,14 @@ public class PgpKeyOperationTest {
 
         parcel.mAddUserIds.add("twi");
         parcel.mAddUserIds.add("pink");
+
+        {
+            int type = 42;
+            byte[] data = new byte[] { 0, 1, 2, 3, 4 };
+            WrappedUserAttribute uat = WrappedUserAttribute.fromSubpacket(type, data);
+            parcel.mAddUserAttribute.add(uat);
+        }
+
         parcel.mNewUnlock = new ChangeUnlockParcel(passphrase);
         PgpKeyOperation op = new PgpKeyOperation(null);
 
@@ -231,6 +239,17 @@ public class PgpKeyOperationTest {
         Assert.assertEquals("number of user ids must be two",
                 2, ring.getPublicKey().getUnorderedUserIds().size());
 
+        ArrayList<WrappedUserAttribute> attributes =
+            ring.getPublicKey().getUnorderedUserAttributes();
+        Assert.assertEquals("number of user attributes must be one",
+                1, attributes.size());
+        Assert.assertEquals("user attribute must be correct type",
+                42, attributes.get(0).getType());
+        Assert.assertEquals("user attribute must have one subpacket",
+                1, attributes.get(0).getSubpackets().length);
+        Assert.assertArrayEquals("user attribute must have correct data",
+                new byte[] { 0, 1, 2, 3, 4 }, attributes.get(0).getSubpackets()[0]);
+
         List<UncachedPublicKey> subkeys = KeyringTestingHelper.itToList(ring.getPublicKeys());
         Assert.assertEquals("number of subkeys must be three", 3, subkeys.size());
 
diff --git a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperation.java b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperation.java
index 89db378a9..2f771d8f2 100644
--- a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperation.java
+++ b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/pgp/PgpKeyOperation.java
@@ -553,7 +553,8 @@ public class PgpKeyOperation {
                         PGPSignature cert = generateUserAttributeSignature(
                                 getSignatureGenerator(masterSecretKey, cryptoInput),
                                 cryptoInput.getSignatureTime(),
-                                masterPrivateKey, masterPublicKey, vector);
+                                masterPrivateKey, masterPublicKey, vector,
+                                masterKeyFlags, masterKeyExpiry);
                         modifiedPublicKey = PGPPublicKey.addCertification(modifiedPublicKey, vector, cert);
                     } catch (NfcInteractionNeeded e) {
                         nfcSignOps.addHash(e.hashToSign, e.hashAlgo);
@@ -1319,11 +1320,9 @@ public class PgpKeyOperation {
 
     }
 
-    private PGPSignature generateUserIdSignature(
-            PGPSignatureGenerator sGen, Date creationTime,
-            PGPPrivateKey masterPrivateKey, PGPPublicKey pKey, String userId, boolean primary,
-            int flags, long expiry)
-            throws IOException, PGPException, SignatureException {
+    private static PGPSignatureSubpacketGenerator generateHashedSelfSigSubpackets(
+            Date creationTime, PGPPublicKey pKey, boolean primary, int flags, long expiry
+    ) {
 
         PGPSignatureSubpacketGenerator hashedPacketsGen = new PGPSignatureSubpacketGenerator();
         {
@@ -1357,6 +1356,17 @@ public class PgpKeyOperation {
             }
         }
 
+        return hashedPacketsGen;
+    }
+
+    private static PGPSignature generateUserIdSignature(
+            PGPSignatureGenerator sGen, Date creationTime,
+            PGPPrivateKey masterPrivateKey, PGPPublicKey pKey, String userId, boolean primary,
+            int flags, long expiry)
+            throws IOException, PGPException, SignatureException {
+
+        PGPSignatureSubpacketGenerator hashedPacketsGen =
+                generateHashedSelfSigSubpackets(creationTime, pKey, primary, flags, expiry);
         sGen.setHashedSubpackets(hashedPacketsGen.generate());
         sGen.init(PGPSignature.POSITIVE_CERTIFICATION, masterPrivateKey);
         return sGen.generateCertification(userId, pKey);
@@ -1365,15 +1375,12 @@ public class PgpKeyOperation {
     private static PGPSignature generateUserAttributeSignature(
             PGPSignatureGenerator sGen, Date creationTime,
             PGPPrivateKey masterPrivateKey, PGPPublicKey pKey,
-            PGPUserAttributeSubpacketVector vector)
+            PGPUserAttributeSubpacketVector vector,
+            int flags, long expiry)
                 throws IOException, PGPException, SignatureException {
 
-        PGPSignatureSubpacketGenerator hashedPacketsGen = new PGPSignatureSubpacketGenerator();
-        {
-            /* critical subpackets: we consider those important for a modern pgp implementation */
-            hashedPacketsGen.setSignatureCreationTime(true, creationTime);
-        }
-
+        PGPSignatureSubpacketGenerator hashedPacketsGen =
+                generateHashedSelfSigSubpackets(creationTime, pKey, false, flags, expiry);
         sGen.setHashedSubpackets(hashedPacketsGen.generate());
         sGen.init(PGPSignature.POSITIVE_CERTIFICATION, masterPrivateKey);
         return sGen.generateCertification(vector, pKey);