diff --git a/internal/util/vault_tokens.go b/internal/util/vault_tokens.go
index 8536a7a21..6cff2a1aa 100644
--- a/internal/util/vault_tokens.go
+++ b/internal/util/vault_tokens.go
@@ -271,7 +271,7 @@ func (kms *VaultTokensKMS) initCertificates(config map[string]interface{}) error
 	// ignore errConfigOptionMissing, no default was set
 	if vaultCAFromSecret != "" {
 		cert, cErr := getCertificate(kms.Tenant, vaultCAFromSecret, "cert")
-		if cErr != nil && !apierrs.IsNotFound(err) {
+		if cErr != nil && !apierrs.IsNotFound(cErr) {
 			return fmt.Errorf("failed to get CA certificate from secret %s: %w", vaultCAFromSecret, cErr)
 		}
 		// if the certificate is not present in tenant namespace get it from