diff --git a/src/tofu.c b/src/tofu.c

index aefac17cf61674d5c40d9554d0cb9089b1519ba4..50a295870876265849eae7fdf0de926a3ad309fd 100644

--- a/src/tofu.c

+++ b/src/tofu.c

@@ -63,6 +63,9 @@ if (err != 0 && err != BR_ERR_X509_TRUNCATED) {

cc->err = err;

return;

}

+ if (br_x509_decoder_isCA(&cc->decoder) && cc->pkey) {

+ return;

+ }

cc->pkey = br_x509_decoder_get_pkey(&cc->decoder);

br_sha512_out(&cc->sha512, &cc->hash);

}