diff --git a/src/certificates.js b/src/certificates.js
index e1a1e418c..d1af2d420 100644
--- a/src/certificates.js
+++ b/src/certificates.js
@@ -6,6 +6,7 @@ var acme = require('./cert/acme.js'),
     assert = require('assert'),
     async = require('async'),
     caas = require('./cert/caas.js'),
+    cloudron = require('./cloudron.js'),
     config = require('./config.js'),
     constants = require('./constants.js'),
     debug = require('debug')('box:src/certificates'),
@@ -65,6 +66,8 @@ function getApi(callback) {
 }
 
 function installAdminCertificate(callback) {
+    if (cloudron.isConfiguredSync()) return callback();
+
     settings.getTlsConfig(function (error, tlsConfig) {
         if (error) return callback(error);
 
diff --git a/src/server.js b/src/server.js
index 1d60231f9..910acece0 100644
--- a/src/server.js
+++ b/src/server.js
@@ -235,8 +235,8 @@ function start(callback) {
     async.series([
         auth.initialize,
         database.initialize,
-        certificates.installAdminCertificate,
         cloudron.initialize, // keep this here because it reads activation state that others depend on
+        certificates.installAdminCertificate, // keep this before cron to block heartbeats until cert is ready
         taskmanager.initialize,
         mailer.initialize,
         cron.initialize,