diff --git a/manifests/certmonger/ca/local.pp b/manifests/certmonger/ca/local.pp
index b7b73281b..d0de3ed8a 100644
--- a/manifests/certmonger/ca/local.pp
+++ b/manifests/certmonger/ca/local.pp
@@ -31,7 +31,7 @@ class tripleo::certmonger::ca::local(
   exec { 'extract-and-trust-ca':
     command   => "${extract_cmd} && ${trust_ca_cmd}",
     path      => '/usr/bin',
-    creates   => $ca_pem,
+    unless    => "test -e ${ca_pem} && openssl x509 -checkend 0 -noout -in ${ca_pem}",
     tries     => 5,
     try_sleep => 1,
     require   => Service['certmonger'],