diff --git a/builtin/logical/pki/path_tidy.go b/builtin/logical/pki/path_tidy.go
index b254321a3693..9b0a86df9cf3 100644
--- a/builtin/logical/pki/path_tidy.go
+++ b/builtin/logical/pki/path_tidy.go
@@ -53,6 +53,10 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 	tidyCertStore := d.Get("tidy_cert_store").(bool)
 	tidyRevocationList := d.Get("tidy_revocation_list").(bool)
 
+	if safetyBuffer < 1 {
+		return logical.ErrorResponse("safety_buffer must be greater than zero"), nil
+	}
+
 	bufferDuration := time.Duration(safetyBuffer) * time.Second
 
 	var resp *logical.Response