diff --git a/qa/qa_cluster.py b/qa/qa_cluster.py
index 09782e5c931ca5a92181f901f5fd67738d7f4ae6..7e74ff9c59399f38dd09eb3faafd864003b17a96 100644
--- a/qa/qa_cluster.py
+++ b/qa/qa_cluster.py
@@ -182,32 +182,45 @@ def TestClusterRenewCrypto():
   AssertNotEqual(StartSSH(master["primary"],
                           utils.ShellQuoteArgs(cmd)).wait(), 0)
 
-  # Custom RAPI certificate
-  fh = tempfile.NamedTemporaryFile()
+  rapi_cert_backup = qa_utils.BackupFile(master["primary"],
+                                         constants.RAPI_CERT_FILE)
+  try:
+    # Custom RAPI certificate
+    fh = tempfile.NamedTemporaryFile()
 
-  # Ensure certificate doesn't cause "gnt-cluster verify" to complain
-  validity = constants.SSL_CERT_EXPIRATION_WARN * 3
+    # Ensure certificate doesn't cause "gnt-cluster verify" to complain
+    validity = constants.SSL_CERT_EXPIRATION_WARN * 3
 
-  bootstrap.GenerateSelfSignedSslCert(fh.name, validity=validity)
+    bootstrap.GenerateSelfSignedSslCert(fh.name, validity=validity)
 
-  tmpcert = qa_utils.UploadFile(master["primary"], fh.name)
-  try:
+    tmpcert = qa_utils.UploadFile(master["primary"], fh.name)
+    try:
+      cmd = ["gnt-cluster", "renew-crypto", "--force",
+             "--rapi-certificate=%s" % tmpcert]
+      AssertEqual(StartSSH(master["primary"],
+                           utils.ShellQuoteArgs(cmd)).wait(), 0)
+    finally:
+      cmd = ["rm", "-f", tmpcert]
+      AssertEqual(StartSSH(master["primary"],
+                           utils.ShellQuoteArgs(cmd)).wait(), 0)
+
+    # Normal case
+    cmd = ["gnt-cluster", "renew-crypto", "--force",
+           "--new-cluster-certificate", "--new-confd-hmac-key",
+           "--new-rapi-certificate"]
+    AssertEqual(StartSSH(master["primary"],
+                         utils.ShellQuoteArgs(cmd)).wait(), 0)
+
+    # Restore RAPI certificate
     cmd = ["gnt-cluster", "renew-crypto", "--force",
-           "--rapi-certificate=%s" % tmpcert]
+           "--rapi-certificate=%s" % rapi_cert_backup]
     AssertEqual(StartSSH(master["primary"],
                          utils.ShellQuoteArgs(cmd)).wait(), 0)
   finally:
-    cmd = ["rm", "-f", tmpcert]
+    cmd = ["rm", "-f", rapi_cert_backup]
     AssertEqual(StartSSH(master["primary"],
                          utils.ShellQuoteArgs(cmd)).wait(), 0)
 
-  # Normal case
-  cmd = ["gnt-cluster", "renew-crypto", "--force",
-         "--new-cluster-certificate", "--new-confd-hmac-key",
-         "--new-rapi-certificate"]
-  AssertEqual(StartSSH(master["primary"],
-                       utils.ShellQuoteArgs(cmd)).wait(), 0)
-
 
 def TestClusterBurnin():
   """Burnin"""