diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index 46e34e3d1..b6817a19d 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -1654,6 +1654,7 @@ match_ms_upn_san(krb5_context context,
     if (list.len != 1) {
 	kdc_log(context, config, 0,
 		"More then one PK-INIT MS UPN SAN");
+	ret = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
 	goto out;
     }