diff --git a/manifests/certmonger/ca/local.pp b/manifests/certmonger/ca/local.pp
index 78dc09a6e..ffdbc961e 100644
--- a/manifests/certmonger/ca/local.pp
+++ b/manifests/certmonger/ca/local.pp
@@ -31,7 +31,7 @@ class tripleo::certmonger::ca::local(
   exec { 'extract-and-trust-ca':
     command   => "${extract_cmd} && ${trust_ca_cmd}",
     path      => '/usr/bin',
-    creates   => $ca_pem,
+    unless    => "test -e ${ca_pem} && openssl x509 -checkend 0 -noout -in ${ca_pem}",
     tries     => 5,
     try_sleep => 1,
   }
diff --git a/spec/classes/tripleo_certmonger_ca_local_spec.rb b/spec/classes/tripleo_certmonger_ca_local_spec.rb
index b6ecebcd1..ddb570573 100644
--- a/spec/classes/tripleo_certmonger_ca_local_spec.rb
+++ b/spec/classes/tripleo_certmonger_ca_local_spec.rb
@@ -34,7 +34,7 @@ describe 'tripleo::certmonger::ca::local' do
 
     it 'should extract CA cert' do
       is_expected.to contain_exec('extract-and-trust-ca').with(
-        :creates => params[:ca_pem],
+        :unless => "test -e #{params[:ca_pem]} && openssl x509 -checkend 0 -noout -in #{params[:ca_pem]}",
       )
     end
   end