diff --git a/pkg/apis/provisioning/v1alpha3/provisioner_defaults.go b/pkg/apis/provisioning/v1alpha3/provisioner_defaults.go
index 3141482eb7d9..0c40252636cd 100644
--- a/pkg/apis/provisioning/v1alpha3/provisioner_defaults.go
+++ b/pkg/apis/provisioning/v1alpha3/provisioner_defaults.go
@@ -50,6 +50,10 @@ func (c *Cluster) GetCABundle(ctx context.Context) (*string, error) {
 		return nil, err
 	}
 	_, err = transport.TLSConfigFor(transportConfig) // fills in CAData!
+	if err != nil {
+		logging.FromContext(ctx).Debugf("Unable to discover caBundle, loading TLS config, %v", err)
+		return nil, err
+	}
 	logging.FromContext(ctx).Debugf("Discovered caBundle, length %d", len(transportConfig.TLS.CAData))
 	return ptr.String(base64.StdEncoding.EncodeToString(transportConfig.TLS.CAData)), nil
 }