diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index b80dbf4de..20c87d421 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -536,7 +536,7 @@ pa_pkinit_validate(astgs_request_t r, const PA_DATA *pa)
 
     ret = _kdc_pk_rd_padata(r, pa, &pkp);
     if (ret || pkp == NULL) {
-        if (ret == HX509_CERT_REVOKED) {
+        if (ret == KRB5_KDC_ERR_REVOKED_CERTIFICATE) {
             ret = KRB5_KDC_ERR_CLIENT_NOT_TRUSTED;
         } else {
             ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;