diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index a5d9ca5..7670109 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -6376,7 +6376,7 @@
 
 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
 {
-    int ret;
+    int ret = 0;
     const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
           ssl->handshake->ciphersuite_info;
 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
@@ -6396,8 +6396,7 @@
         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
-        ssl->state++;
-        return( 0 );
+        goto exit;
     }
 
 #if defined(MBEDTLS_SSL_SRV_C)
@@ -6405,8 +6404,7 @@
         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
-        ssl->state++;
-        return( 0 );
+        goto exit;
     }
 
     if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
@@ -6414,9 +6412,7 @@
     {
         ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
-
-        ssl->state++;
-        return( 0 );
+        goto exit;
     }
 #endif
 
@@ -6440,12 +6436,13 @@
     if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
     {
         ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
-        ssl->state++;
 
         if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
-            return( 0 );
+            ret = 0;
+        else
+            ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
 
-        return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
+        goto exit;
     }
 #endif /* MBEDTLS_SSL_SRV_C */
 
@@ -6453,10 +6450,7 @@
     ssl_clear_peer_cert( ssl->session_negotiate );
 
     if( ( ret = ssl_parse_certificate_chain( ssl ) ) != 0 )
-    {
-        ssl->state++;
-        return( ret );
-    }
+        goto exit;
 
 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
     if( ssl->handshake->ecrs_enabled)
@@ -6602,10 +6596,11 @@
 #endif /* MBEDTLS_DEBUG_C */
     }
 
-    ssl->state++;
-
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
 
+exit:
+
+    ssl->state++;
     return( ret );
 }
 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED