diff --git a/src/pluto/ca.c b/src/pluto/ca.c
index 175c0b022..827b98121 100644
--- a/src/pluto/ca.c
+++ b/src/pluto/ca.c
@@ -219,7 +219,8 @@ cert_t* get_authcert(identification_t *subject, chunk_t keyid,
 		}
 
 		/* compare the subjectDistinguishedNames */
-		if (!certificate->has_subject(certificate, subject))
+		if (!(subject && certificate->has_subject(certificate, subject)) &&
+			 (subject || !keyid.ptr))
 		{
 			continue;
 		}