diff --git a/communicator/config.go b/communicator/config.go
index 331104b3e..e9160d919 100644
--- a/communicator/config.go
+++ b/communicator/config.go
@@ -503,12 +503,12 @@ func (c *Config) prepareSSH(ctx *interpolate.Context) []error {
 
 		if c.SSHBastionPrivateKeyFile == "" && c.SSHPrivateKeyFile != "" {
 			c.SSHBastionPrivateKeyFile = c.SSHPrivateKeyFile
-		}
 
-		if c.SSHBastionCertificateFile == "" && c.SSHCertificateFile != "" {
-			c.SSHBastionCertificateFile = c.SSHCertificateFile
+			// Only try to set the bastion certificate to the ssh certificate if the bastion private key isn't set
+			if c.SSHBastionCertificateFile == "" && c.SSHCertificateFile != "" {
+				c.SSHBastionCertificateFile = c.SSHCertificateFile
+			}
 		}
-
 	}
 
 	if c.SSHProxyHost != "" {