diff --git a/src/tls.py b/src/tls.py
index 8286fb4c..b1e431f9 100644
--- a/src/tls.py
+++ b/src/tls.py
@@ -91,6 +91,10 @@ def _on_certificate_available(self, event) -> None:
             event.defer()
             return
 
+        if not self.charm.container.can_connect():
+            event.defer()
+            return
+
         # avoid setting tls files and restarting
         if event.certificate_signing_request != self.csr:
             logger.error("Can't use certificate, found unknown CSR")