diff --git a/controller/model/authenticator_handlers.go b/controller/model/authenticator_handlers.go
index 54f729528..f7ca2fa05 100644
--- a/controller/model/authenticator_handlers.go
+++ b/controller/model/authenticator_handlers.go
@@ -161,6 +161,10 @@ func (handler AuthenticatorHandler) ReadByFingerprint(fingerprint string) (*Auth
 		return nil, err
 	}
 
+	if entity == nil {
+		return nil, nil
+	}
+
 	authenticator, ok := entity.(*Authenticator)
 
 	if !ok {
diff --git a/controller/model/authenticator_mod_cert.go b/controller/model/authenticator_mod_cert.go
index d1802bd59..708db0d20 100644
--- a/controller/model/authenticator_mod_cert.go
+++ b/controller/model/authenticator_mod_cert.go
@@ -60,13 +60,13 @@ func (module *AuthModuleCert) Process(context AuthContext) (string, error) {
 
 	for fingerprint := range fingerprints {
 		authenticator, err := module.env.GetHandlers().Authenticator.ReadByFingerprint(fingerprint)
-		curCert := fingerprints[fingerprint]
 
 		if err != nil {
 			pfxlog.Logger().WithError(err).Errorf("error during cert auth read by fingerprint %s", fingerprint)
 		}
 
 		if authenticator != nil {
+			curCert := fingerprints[fingerprint]
 			if authCert, ok := authenticator.SubType.(*AuthenticatorCert); ok {
 				if authCert.Pem == "" {
 					certPem := pem.EncodeToMemory(&pem.Block{