diff --git a/internal/identity/manager.go b/internal/identity/manager.go
index 88f1801..792de54 100644
--- a/internal/identity/manager.go
+++ b/internal/identity/manager.go
@@ -44,10 +44,6 @@ func NewManager(engine *store.Engine, masterKey [32]byte, prefix string, cooldow
 }
 
 func (m *Manager) Allocate(pubKey [32]byte) (*Identity, error) {
-	if existing, err := m.GetByPubKey(pubKey); err == nil {
-		return existing, nil
-	}
-
 	var number string
 	for attempts := 0; attempts < 100; attempts++ {
 		number = GenerateNumber(m.prefix)
diff --git a/internal/server/server.go b/internal/server/server.go
index 3361623..9cf60e8 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -344,14 +344,15 @@ func (s *Server) handleAuthCert(sess *Session, payload []byte) {
 	var pubKey [32]byte
 	copy(pubKey[:], pubKeyRaw)
 
-	ident, err := s.identMgr.GetByPubKey(pubKey)
+	number := cert.Subject.CommonName
+	ident, err := s.identMgr.GetByNumber(number)
 	if err != nil {
-		sendOpError(sess.Stream(), types.ErrAuthFailed, "identity not found")
+		sendOpError(sess.Stream(), types.ErrAuthFailed, "identity not found for cert number")
 		return
 	}
 
-	if sess.IsAuthenticated() && sess.Number() != ident.Number {
-		sendOpError(sess.Stream(), types.ErrAuthFailed, "cert number mismatch")
+	if ident.PubKey != pubKey {
+		sendOpError(sess.Stream(), types.ErrAuthFailed, "cert key mismatch")
 		return
 	}