diff --git a/modules/caddypki/ca.go b/modules/caddypki/ca.go
index 6c48da6f9..5b17518ca 100644
--- a/modules/caddypki/ca.go
+++ b/modules/caddypki/ca.go
@@ -124,8 +124,6 @@ func (ca *CA) Provision(ctx caddy.Context, id string, log *zap.Logger) error {
 	}
 	if ca.IntermediateLifetime == 0 {
 		ca.IntermediateLifetime = caddy.Duration(defaultIntermediateLifetime)
-	} else if time.Duration(ca.IntermediateLifetime) >= defaultRootLifetime {
-		return fmt.Errorf("intermediate certificate lifetime must be less than root certificate lifetime (%s)", defaultRootLifetime)
 	}
 
 	// load the certs and key that will be used for signing
@@ -144,6 +142,10 @@ func (ca *CA) Provision(ctx caddy.Context, id string, log *zap.Logger) error {
 	if err != nil {
 		return err
 	}
+	actualRootLifetime := time.Until(rootCert.NotAfter)
+	if time.Duration(ca.IntermediateLifetime) >= actualRootLifetime {
+		return fmt.Errorf("intermediate certificate lifetime must be less than actual root certificate lifetime (%s)", actualRootLifetime)
+	}
 	if ca.Intermediate != nil {
 		interCert, interKey, err = ca.Intermediate.Load()
 	} else {