diff --git a/cmd/webhook.go b/cmd/webhook.go
index 2d1db31b4..639801e68 100644
--- a/cmd/webhook.go
+++ b/cmd/webhook.go
@@ -98,7 +98,9 @@ var webhookCmd = &cobra.Command{
 					setupLog.Info("validating certs")
 					err = crds.CheckCerts(c, dnsName, time.Now().Add(certLookaheadInterval))
 					if err != nil {
+						setupLog.Error(err, "certs are not valid at now + lookahead, triggering shutdown", "certLookahead", certLookaheadInterval.String())
 						cancel()
+						return
 					}
 					setupLog.Info("certs are valid")
 				}