diff --git a/CHANGELOG.unreleased.md b/CHANGELOG.unreleased.md
index 703a40979d0..8a068cfd09e 100644
--- a/CHANGELOG.unreleased.md
+++ b/CHANGELOG.unreleased.md
@@ -40,6 +40,7 @@
 
 - xo-server minor
 - xo-server-perf-alert minor
+- xo-server-sdn-controller patch
 - xo-web minor
 
 <!--packages-end-->
diff --git a/packages/xo-server-sdn-controller/src/index.js b/packages/xo-server-sdn-controller/src/index.js
index 358cc09223a..323489ab3e2 100644
--- a/packages/xo-server-sdn-controller/src/index.js
+++ b/packages/xo-server-sdn-controller/src/index.js
@@ -343,7 +343,7 @@ class SDNController extends EventEmitter {
 
     await Promise.all(
       map(this._xo.getAllXapis(), async xapi => {
-        if (xapi.status === 'connected') {
+        if (xapi.status === 'connected' && !xapi.readOnly) {
           await this._installCaCertificateIfNeeded(xapi)
         }
       })