diff --git a/base/server/python/pki/server/deployment/scriptlets/configuration.py b/base/server/python/pki/server/deployment/scriptlets/configuration.py
index 82bc80fb4ce..f9c1d0ae99c 100644
--- a/base/server/python/pki/server/deployment/scriptlets/configuration.py
+++ b/base/server/python/pki/server/deployment/scriptlets/configuration.py
@@ -77,8 +77,6 @@ def spawn(self, deployer):
                 deployer.update_system_certs(nssdb, subsystem)
                 subsystem.save()
 
-                deployer.validate_system_certs(nssdb, subsystem)
-
             elif len(subsystems) > 1:
 
                 for s in subsystems:
@@ -246,12 +244,13 @@ def spawn(self, deployer):
 
         try:
             system_certs = deployer.setup_system_certs(nssdb, subsystem)
+            subsystem.save()
+
+            deployer.validate_system_certs(nssdb, subsystem)
 
         finally:
             nssdb.close()
 
-        subsystem.save()
-
         if config.str2bool(deployer.mdict['pki_security_domain_setup']) and \
                 subsystem.type == 'CA':
             logger.info('Setting up subsystem user')