diff --git a/cmd/kubeadm/app/phases/certs/certs.go b/cmd/kubeadm/app/phases/certs/certs.go
index a17db314447..8dec8c1daba 100644
--- a/cmd/kubeadm/app/phases/certs/certs.go
+++ b/cmd/kubeadm/app/phases/certs/certs.go
@@ -477,12 +477,11 @@ func validateCertificateWithConfig(cert *x509.Certificate, baseName string, cfg
 // by keeping track with a cache.
 func CheckCertificatePeriodValidity(baseName string, cert *x509.Certificate) {
 	certPeriodValidationMutex.Lock()
+	defer certPeriodValidationMutex.Unlock()
 	if _, exists := certPeriodValidation[baseName]; exists {
-		certPeriodValidationMutex.Unlock()
 		return
 	}
 	certPeriodValidation[baseName] = struct{}{}
-	certPeriodValidationMutex.Unlock()
 
 	klog.V(5).Infof("validating certificate period for %s certificate", baseName)
 	if err := pkiutil.ValidateCertPeriod(cert, 0); err != nil {