diff --git a/src/tofu.c b/src/tofu.c

index 5b34850de9e17dcd59fc64a3227cd92bfb0a6cef..570bd41c885cd9bb007b58bffca957ace6916bea 100644

--- a/src/tofu.c

+++ b/src/tofu.c

@@ -25,7 +25,7 @@ static void

xt_start_cert(const br_x509_class **ctx, uint32_t length)

{

struct x509_tofu_context *cc = (struct x509_tofu_context *)(void *)ctx;

- if (cc->err != 0) {

+ if (cc->err != 0 || cc->pkey) {

return;

}

if (length == 0) {

@@ -40,7 +40,7 @@ static void

xt_append(const br_x509_class **ctx, const unsigned char *buf, size_t len)

{

struct x509_tofu_context *cc = (struct x509_tofu_context *)(void *)ctx;

- if (cc->err != 0) {

+ if (cc->err != 0 || cc->pkey) {

return;

}

br_x509_decoder_push(&cc->decoder, buf, len);

@@ -63,7 +63,7 @@ if (err != 0 && err != BR_ERR_X509_TRUNCATED) {

cc->err = err;

return;

}

- if (br_x509_decoder_isCA(&cc->decoder) && cc->pkey) {

+ if (br_x509_decoder_isCA(&cc->decoder)) {

return;

}

cc->pkey = br_x509_decoder_get_pkey(&cc->decoder);