diff --git a/lib/hx509/cms.c b/lib/hx509/cms.c
index 37c437788..af3dd47aa 100644
--- a/lib/hx509/cms.c
+++ b/lib/hx509/cms.c
@@ -242,7 +242,10 @@ unparse_CMSIdentifier(hx509_context context,
 	if (len < 0)
 	    return ENOMEM;
 
-	ret = asprintf(str, "certificate with id %s", keyid);
+	if (len)
+	    ret = asprintf(str, "certificate with id %s", keyid);
+	else
+	    ret = asprintf(str, "certificate");
 	free(keyid);
 	break;
     }