diff --git a/pkg/scope/provider.go b/pkg/scope/provider.go
index e3204a9d8c..50592c2f40 100644
--- a/pkg/scope/provider.go
+++ b/pkg/scope/provider.go
@@ -153,13 +153,13 @@ func NewProviderClient(cloud clientconfig.Cloud, caCert []byte, logger logr.Logg
 	}
 
 	config := &tls.Config{
-		RootCAs:    x509.NewCertPool(),
 		MinVersion: tls.VersionTLS12,
 	}
 	if cloud.Verify != nil {
 		config.InsecureSkipVerify = !*cloud.Verify
 	}
 	if caCert != nil {
+		config.RootCAs = x509.NewCertPool()
 		config.RootCAs.AppendCertsFromPEM(caCert)
 	}