diff --git a/cmd/kubeadm/app/apis/kubeadm/validation/validation.go b/cmd/kubeadm/app/apis/kubeadm/validation/validation.go
index c12795603e1..24e1fa0147e 100644
--- a/cmd/kubeadm/app/apis/kubeadm/validation/validation.go
+++ b/cmd/kubeadm/app/apis/kubeadm/validation/validation.go
@@ -783,7 +783,7 @@ func ValidateUpgradeConfiguration(c *kubeadm.UpgradeConfiguration) field.ErrorLi
 	return allErrs
 }
 
-// ValidateCertValidity validates if the values for cert validity are too big
+// ValidateCertValidity validates if the values for cert validity are too big or don't match
 func ValidateCertValidity(cfg *kubeadm.ClusterConfiguration) []error {
 	var allErrs []error
 	if cfg.CertificateValidityPeriod != nil && cfg.CertificateValidityPeriod.Duration > constants.CertificateValidityPeriod {
@@ -796,5 +796,12 @@ func ValidateCertValidity(cfg *kubeadm.ClusterConfiguration) []error {
 			errors.Errorf("caCertificateValidityPeriod: the value %v is more than the recommended default for CA certificate expiration: %v",
 				cfg.CACertificateValidityPeriod.Duration, constants.CACertificateValidityPeriod))
 	}
+	if cfg.CertificateValidityPeriod != nil && cfg.CACertificateValidityPeriod != nil {
+		if cfg.CertificateValidityPeriod.Duration > cfg.CACertificateValidityPeriod.Duration {
+			allErrs = append(allErrs,
+				errors.Errorf("certificateValidityPeriod: the value %v is more than the caCertificateValidityPeriod: %v",
+					cfg.CertificateValidityPeriod.Duration, cfg.CACertificateValidityPeriod.Duration))
+		}
+	}
 	return allErrs
 }
diff --git a/cmd/kubeadm/app/apis/kubeadm/validation/validation_test.go b/cmd/kubeadm/app/apis/kubeadm/validation/validation_test.go
index 04705707b53..5147c7ce6cd 100644
--- a/cmd/kubeadm/app/apis/kubeadm/validation/validation_test.go
+++ b/cmd/kubeadm/app/apis/kubeadm/validation/validation_test.go
@@ -21,6 +21,7 @@ import (
 	"os"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/spf13/pflag"
 
@@ -1585,6 +1586,18 @@ func TestValidateCertValidity(t *testing.T) {
 			},
 			expectedErrors: 2,
 		},
+		{
+			name: "one error from mismatched durations (CertificateValidityPeriod > CACertificateValidityPeriod) ",
+			cfg: &kubeadmapi.ClusterConfiguration{
+				CertificateValidityPeriod: &metav1.Duration{
+					Duration: time.Hour * 2,
+				},
+				CACertificateValidityPeriod: &metav1.Duration{
+					Duration: time.Hour,
+				},
+			},
+			expectedErrors: 1,
+		},
 	}
 
 	for _, tc := range tests {