diff --git a/cluster/certificates.go b/cluster/certificates.go
index f51efe72..939051a5 100644
--- a/cluster/certificates.go
+++ b/cluster/certificates.go
@@ -265,14 +265,22 @@ func (c *Cluster) SaveBackupCertificateBundle(ctx context.Context) error {
 func (c *Cluster) ExtractBackupCertificateBundle(ctx context.Context) error {
 	backupHosts := c.getBackupHosts()
 	var errgrp errgroup.Group
-
+	errList := []string{}
 	for _, host := range backupHosts {
 		runHost := host
 		errgrp.Go(func() error {
-			return pki.ExtractBackupBundleOnHost(ctx, runHost, c.SystemImages.Alpine, services.EtcdSnapshotPath, c.PrivateRegistriesMap)
+			if err := pki.ExtractBackupBundleOnHost(ctx, runHost, c.SystemImages.Alpine, services.EtcdSnapshotPath, c.PrivateRegistriesMap); err != nil {
+				errList = append(errList, fmt.Errorf(
+					"Failed to extract certificate bundle on host [%s], please make sure etcd bundle exist in /opt/rke/etcd-snapshots/pki.bundle.tar.gz: %v", runHost.Address, err).Error())
+			}
+			return nil
 		})
 	}
-	return errgrp.Wait()
+	errgrp.Wait()
+	if len(errList) == len(backupHosts) {
+		return fmt.Errorf(strings.Join(errList, ","))
+	}
+	return nil
 }
 
 func (c *Cluster) getBackupHosts() []*hosts.Host {
diff --git a/pki/pki.go b/pki/pki.go
index 3535cf9e..c763c530 100644
--- a/pki/pki.go
+++ b/pki/pki.go
@@ -249,7 +249,7 @@ func ExtractBackupBundleOnHost(ctx context.Context, host *hosts.Host, alpineSyst
 		Cmd: []string{
 			"sh",
 			"-c",
-			fmt.Sprintf("if [ -f %s ];then tar xzvf %s -C %s --strip-components %d; fi", BundleCertPath, BundleCertPath, fullTempCertPath, len(strings.Split(fullTempCertPath, "/"))-1),
+			fmt.Sprintf("mkdir -p /etc/kubernetes/.tmp/; tar xzvf %s -C %s --strip-components %d", BundleCertPath, fullTempCertPath, len(strings.Split(fullTempCertPath, "/"))-1),
 		},
 		Image: alpineSystemImage,
 	}