diff --git a/br/pkg/lightning/config/config.go b/br/pkg/lightning/config/config.go
index a45d4e6f58fb8..d080d1bad16cf 100644
--- a/br/pkg/lightning/config/config.go
+++ b/br/pkg/lightning/config/config.go
@@ -577,7 +577,7 @@ func (sec *Security) RegisterMySQL() error {
 
 // DeregisterMySQL deregisters the TLS config with security.TLSConfigName
 func (sec *Security) DeregisterMySQL() {
-	if sec == nil {
+	if sec == nil || len(sec.CAPath) == 0 {
 		return
 	}
 	gomysql.DeregisterTLSConfig(sec.TLSConfigName)