diff --git a/kdc/ca.c b/kdc/ca.c
index 78a1c65cc..4402c4467 100644
--- a/kdc/ca.c
+++ b/kdc/ca.c
@@ -129,5 +129,5 @@ kdc_issue_certificate(krb5_context context,
                                           out);
     if (ret == EACCES)
         ret = KRB5KDC_ERR_POLICY;
-    return (ret == EACCES) ? KRB5KDC_ERR_POLICY : ret;
+    return ret;
 }