diff --git a/sw/host/provisioning/orchestrator/src/orchestrator.py b/sw/host/provisioning/orchestrator/src/orchestrator.py
index 53506b04171fa..e8d25e8f05df9 100644
--- a/sw/host/provisioning/orchestrator/src/orchestrator.py
+++ b/sw/host/provisioning/orchestrator/src/orchestrator.py
@@ -36,21 +36,24 @@ def get_user_confirmation(
 SKU:      {sku_config.name}
 LC State: {sku_config.target_lc_state}
 
+[OTHER]
+fpga:          {args.fpga}
+> commit hash: {commit_hash}
+
 [DICE CA]
 certificate: {sku_config.dice_ca.certificate}
 key:         {sku_config.dice_ca.key}
 key type:    {sku_config.dice_ca.key_type}
 key ID:      {sku_config.dice_ca.key_id}
+""")
+    if sku_config.ext_ca:
+        print(f"""
 
 [EXTENSION CA]
 certificate: {sku_config.ext_ca.certificate}
 key:         {sku_config.ext_ca.key}
 key type:    {sku_config.ext_ca.key_type}
 key ID:      {sku_config.ext_ca.key_id}
-
-[OTHER]
-fpga:          {args.fpga}
-> commit hash: {commit_hash}
 """)
     if not args.non_interactive:
         confirm()
diff --git a/sw/host/provisioning/orchestrator/src/sku_config.py b/sw/host/provisioning/orchestrator/src/sku_config.py
index a6a17658958aa..41c466f594a7b 100644
--- a/sw/host/provisioning/orchestrator/src/sku_config.py
+++ b/sw/host/provisioning/orchestrator/src/sku_config.py
@@ -26,9 +26,9 @@ class SkuConfig:
     target_lc_state: str  # valid: must be in ["dev", "prod", "prod_end"]
     otp: str  # valid: any string
     perso_bin: str  # valid: any string
-    dice_ca: Optional[OrderedDict]  # valid: see CaConfig
-    ext_ca: Optional[OrderedDict]  # valid: see CaConfig
     token_encrypt_key: str
+    dice_ca: Optional[OrderedDict]  # valid: see CaConfig
+    ext_ca: Optional[OrderedDict] = None  # valid: see CaConfig
 
     def __post_init__(self):
         # Load CA configs.