diff --git a/key.c b/key.c
index 57ad9fd..5886d44 100644
--- a/key.c
+++ b/key.c
@@ -1517,8 +1517,8 @@ key_certify(Key *k, Key *ca)
buffer_put_cstring(&k->cert->certblob, key_ssh_name(k));
/* -v01 certs put nonce first */
+ arc4random_buf(&nonce, sizeof(nonce));
if (k->type == KEY_DSA_CERT || k->type == KEY_RSA_CERT) {
- arc4random_buf(&nonce, sizeof(nonce));
buffer_put_string(&k->cert->certblob, nonce, sizeof(nonce));
}