diff --git a/pkg/venafi/tpp/connector.go b/pkg/venafi/tpp/connector.go
index 28784e42..6487de97 100644
--- a/pkg/venafi/tpp/connector.go
+++ b/pkg/venafi/tpp/connector.go
@@ -1202,11 +1202,6 @@ func (c *Connector) RetrieveCertificate(req *certificate.Request) (certificates
 	includeChain := req.ChainOption != certificate.ChainOptionIgnore
 	rootFirstOrder := includeChain && req.ChainOption == certificate.ChainOptionRootFirst
 
-	// if Request doesn't contain a Format, use defaults
-	if req.KeyType == certificate.KeyTypeRSA {
-		req.Format = certificate.CertFormatBase64PKCS8
-	}
-
 	if req.PickupID == "" && req.Thumbprint != "" {
 		// search cert by Thumbprint and fill pickupID
 		searchResult, err := c.searchCertificatesByFingerprint(req.Thumbprint)
@@ -1234,6 +1229,11 @@ func (c *Connector) RetrieveCertificate(req *certificate.Request) (certificates
 		certReq.Password = req.KeyPassword
 	}
 
+	// if Request doesn't contain a Format, use defaults
+	if req.KeyType == certificate.KeyTypeRSA {
+		req.Format = certificate.CertFormatBase64PKCS8
+	}
+
 	startTime := time.Now()
 	for {
 		var retrieveResponse *certificateRetrieveResponse