diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index b6f1252d2..b27f401e1 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -863,7 +863,8 @@ process_incoming_push_request(struct context *c)
         send_auth_failed(c, client_reason);
         ret = PUSH_MSG_AUTH_FAILURE;
     }
-    else if (c->c2.tls_multi->multi_state >= CAS_CONNECT_DONE)
+    else if (tls_authentication_status(c->c2.tls_multi) == TLS_AUTHENTICATION_SUCCEEDED
+        && c->c2.tls_multi->multi_state >= CAS_CONNECT_DONE)
     {
         time_t now;