diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index 90a39a1..dbe9d27 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -12348,44 +12348,47 @@ static bool acl_check_ssl(THD *thd, const ACL_USER *acl_user)
         return 1;
       }
     }
-    /* Prepare certificate (if exists) */
-    if (!(cert= SSL_get_peer_certificate(ssl)))
-      return 1;
-    /* If X509 issuer is specified, we check it... */
-    if (acl_user->x509_issuer)
+    if (acl_user->x509_issuer || acl_user->x509_subject)
     {
-      char *ptr= X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
-      DBUG_PRINT("info", ("comparing issuers: '%s' and '%s'",
-                         acl_user->x509_issuer, ptr));
-      if (strcmp(acl_user->x509_issuer, ptr))
+      /* Prepare certificate (if exists) */
+      if (!(cert= SSL_get_peer_certificate(ssl)))
+        return 1;
+      /* If X509 issuer is specified, we check it... */
+      if (acl_user->x509_issuer)
       {
-        if (global_system_variables.log_warnings)
-          sql_print_information("X509 issuer mismatch: should be '%s' "
-                            "but is '%s'", acl_user->x509_issuer, ptr);
+        char *ptr= X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
+        DBUG_PRINT("info", ("comparing issuers: '%s' and '%s'",
+                           acl_user->x509_issuer, ptr));
+        if (strcmp(acl_user->x509_issuer, ptr))
+        {
+          if (global_system_variables.log_warnings)
+            sql_print_information("X509 issuer mismatch: should be '%s' "
+                              "but is '%s'", acl_user->x509_issuer, ptr);
+          free(ptr);
+          X509_free(cert);
+          return 1;
+        }
         free(ptr);
-        X509_free(cert);
-        return 1;
       }
-      free(ptr);
-    }
-    /* X509 subject is specified, we check it .. */
-    if (acl_user->x509_subject)
-    {
-      char *ptr= X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
-      DBUG_PRINT("info", ("comparing subjects: '%s' and '%s'",
-                         acl_user->x509_subject, ptr));
-      if (strcmp(acl_user->x509_subject, ptr))
+      /* X509 subject is specified, we check it .. */
+      if (acl_user->x509_subject)
       {
-        if (global_system_variables.log_warnings)
-          sql_print_information("X509 subject mismatch: should be '%s' but is '%s'",
-                          acl_user->x509_subject, ptr);
+        char *ptr= X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
+        DBUG_PRINT("info", ("comparing subjects: '%s' and '%s'",
+                           acl_user->x509_subject, ptr));
+        if (strcmp(acl_user->x509_subject, ptr))
+        {
+          if (global_system_variables.log_warnings)
+            sql_print_information("X509 subject mismatch: should be '%s' but is '%s'",
+                            acl_user->x509_subject, ptr);
+          free(ptr);
+          X509_free(cert);
+          return 1;
+        }
         free(ptr);
-        X509_free(cert);
-        return 1;
       }
-      free(ptr);
+      X509_free(cert);
     }
-    X509_free(cert);
     return 0;
 #else  /* HAVE_OPENSSL */
   default: