diff --git a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
index 576aa4c63..d8c4570dc 100644
--- a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+++ b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
@@ -153,6 +153,13 @@ static signature_scheme_t select_signature_scheme(keymat_v2_t *keymat,
 			}
 		}
 		enumerator->destroy(enumerator);
+
+		/* default to the scheme we'd use with classic authentication */
+		if (selected == SIGN_UNKNOWN && key_type == KEY_RSA &&
+			keymat->hash_algorithm_supported(keymat, HASH_SHA1))
+		{
+			selected = SIGN_RSA_EMSA_PKCS1_SHA1;
+		}
 	}
 	return selected;
 }