diff --git a/kdc/kx509.c b/kdc/kx509.c
index 358fd6098..c012fa7e8 100644
--- a/kdc/kx509.c
+++ b/kdc/kx509.c
@@ -384,8 +384,10 @@ _kdc_do_kx509(krb5_context context,
 	if (ret)
 	    goto out;
 	free_RSAPublicKey(&key);
-	if (size != req->pk_key.length)
-	    ;
+	if (size != req->pk_key.length) {
+	    ret = ASN1_EXTRA_DATA;
+	    goto out;
+	}
     }
 
     ALLOC(rep.certificate);