diff --git a/internal/server/server.go b/internal/server/server.go
index e5bfb26..3361623 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -351,7 +351,8 @@ func (s *Server) handleAuthCert(sess *Session, payload []byte) {
 	}
 
 	if sess.IsAuthenticated() && sess.Number() != ident.Number {
-		s.Unregister(sess.Number())
+		sendOpError(sess.Stream(), types.ErrAuthFailed, "cert number mismatch")
+		return
 	}
 
 	sess.Authenticate(ident.Number, pubKey, certDER)