diff --git a/kdc/kx509.c b/kdc/kx509.c
index 6217f5c55..5dba3c0a1 100644
--- a/kdc/kx509.c
+++ b/kdc/kx509.c
@@ -940,7 +940,8 @@ _kdc_do_kx509(kx509_req_context r)
         goto out;
     }
 
-    ret = krb5_unparse_name(r->context, cprincipal, &r->cname);
+    if (ret == 0)
+	ret = krb5_unparse_name(r->context, cprincipal, &r->cname);
 
     /* Check that the service name is a valid kx509 service name */
     if (ret == 0)