diff --git a/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp b/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp
index 024a6e5..5708d0a 100644
--- a/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp
+++ b/global/overlay/etc/puppet/modules/cdn/manifests/ca.pp
@@ -35,23 +35,25 @@ class cdn::ca(
     mode   => '0750',
   }
 
-  if $ca_secrets['key_password'] {
-    file { '/opt/step-ca/init/secrets/key-password':
-      ensure => file,
-      owner  => '1000',
-      group  => '1000',
-      mode   => '0640',
-      content => template('cdn/ca/password.erb'),
+  if $ca_secrets {
+    if $ca_secrets['key_password'] {
+      file { '/opt/step-ca/init/secrets/key-password':
+        ensure => file,
+        owner  => '1000',
+        group  => '1000',
+        mode   => '0640',
+        content => template('cdn/ca/password.erb'),
+      }
     }
-  }
 
-  if $ca_secrets['provisioner_password'] {
-    file { '/opt/step-ca/init/secrets/provisioner-password':
-      ensure => file,
-      owner  => '1000',
-      group  => '1000',
-      mode   => '0640',
-      content => template('cdn/ca/password.erb'),
+    if $ca_secrets['provisioner_password'] {
+      file { '/opt/step-ca/init/secrets/provisioner-password':
+        ensure => file,
+        owner  => '1000',
+        group  => '1000',
+        mode   => '0640',
+        content => template('cdn/ca/password.erb'),
+      }
     }
   }