diff --git a/README.md b/README.md
index 93615f0..094a231 100644
--- a/README.md
+++ b/README.md
@@ -29,6 +29,8 @@ More information about `debops.pki` can be found in the
 
 - `debops.secret`
 
+This role runs some tasks on `localhost`. The machine running debops needs to have `make` and `openssl` available.
+
 ### Are you using this as a standalone role without DebOps?
 
 You may need to include missing roles from the [DebOps common
diff --git a/templates/secret/pki/make.sh.j2 b/templates/secret/pki/make.sh.j2
index 977c255..40edfbe 100755
--- a/templates/secret/pki/make.sh.j2
+++ b/templates/secret/pki/make.sh.j2
@@ -1,6 +1,8 @@
 #!/bin/sh
 # This file is managed remotely, all changes will be lost
 
+set -e
+
 MAKE="make --silent --no-print-directory"
 
 ROOTCA="authorities/root"