diff --git a/internal/server/server.go b/internal/server/server.go
index 8bbcf85..e5bfb26 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -350,6 +350,10 @@ func (s *Server) handleAuthCert(sess *Session, payload []byte) {
 		return
 	}
 
+	if sess.IsAuthenticated() && sess.Number() != ident.Number {
+		s.Unregister(sess.Number())
+	}
+
 	sess.Authenticate(ident.Number, pubKey, certDER)
 	s.Register(sess, ident.Number)