diff --git a/agent/consul/auto_encrypt_endpoint.go b/agent/consul/auto_encrypt_endpoint.go
index 4a700d48ba..a8267da076 100644
--- a/agent/consul/auto_encrypt_endpoint.go
+++ b/agent/consul/auto_encrypt_endpoint.go
@@ -35,6 +35,9 @@ func (a *AutoEncrypt) Sign(
 	rootsArgs := structs.DCSpecificRequest{Datacenter: args.Datacenter}
 	roots := structs.IndexedCARoots{}
 	err := c.Roots(&rootsArgs, &roots)
+	if err != nil {
+		return err
+	}
 
 	cert := structs.IssuedCert{}
 	err = c.Sign(args, &cert)