diff --git a/cmd/dkl-local-server/secrets.go b/cmd/dkl-local-server/secrets.go
index f8afcef..490ea5e 100644
--- a/cmd/dkl-local-server/secrets.go
+++ b/cmd/dkl-local-server/secrets.go
@@ -248,6 +248,13 @@ func (sd *SecretData) RenewCACert(cluster, name string) (err error) {
 }
 
 func (sd *SecretData) CA(cluster, name string) (ca *CA, err error) {
+
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("cluster %s CA %s: %w", cluster, name, err)
+		}
+	}()
+
 	cs := sd.cluster(cluster)
 
 	ca, ok := cs.CAs[name]
@@ -257,6 +264,9 @@ func (sd *SecretData) CA(cluster, name string) (ca *CA, err error) {
 			log.Infof("secret-data cluster %s: CA %s: regenerating certificate: %v", cluster, name, checkErr)
 
 			err = sd.RenewCACert(cluster, name)
+			if err != nil {
+				err = fmt.Errorf("renew: %w", err)
+			}
 		}
 
 		return
@@ -283,6 +293,7 @@ func (sd *SecretData) CA(cluster, name string) (ca *CA, err error) {
 
 	cert, _, key, err := initca.New(req)
 	if err != nil {
+		err = fmt.Errorf("initca: %w", err)
 		return
 	}