diff --git a/src/main/java/net/siegeln/cameleer/saas/certificate/CertificateService.java b/src/main/java/net/siegeln/cameleer/saas/certificate/CertificateService.java
index 19d07eb..8bc0f79 100644
--- a/src/main/java/net/siegeln/cameleer/saas/certificate/CertificateService.java
+++ b/src/main/java/net/siegeln/cameleer/saas/certificate/CertificateService.java
@@ -132,6 +132,7 @@ public class CertificateService {
     public long countStaleTenants() {
         var active = certRepository.findByStatus(CertificateEntity.Status.ACTIVE).orElse(null);
         if (active == null || active.getActivatedAt() == null) return 0;
+        if (!active.isHasCa()) return 0; // no CA bundle to propagate
         return tenantRepository.countByCaAppliedAtBeforeOrCaAppliedAtIsNull(active.getActivatedAt());
     }