--- lib/nss.c.orig	2009-07-15 20:16:54.733230699 +0200
+++ lib/nss.c	2009-07-15 20:27:35.996222691 +0200
@@ -769,8 +769,6 @@ static SECStatus SelectClientCert(void *
       failf(data, "NSS: client certificate not found: %s", nickname);
       return SECFailure;
     }
-    infof(data, "NSS: Client client certificate: %s\n", nickname);
-    display_cert_info(data, *pRetCert);
 
     slot = PK11_FindSlotByName(pem_slotname);
     if (NULL == slot) {
@@ -785,6 +783,8 @@ static SECStatus SelectClientCert(void *
       return SECFailure;
     }
 
+    infof(data, "NSS: Client client certificate: %s\n", nickname);
+    display_cert_info(data, *pRetCert);
     return SECSuccess;
   }
 
@@ -793,8 +793,7 @@ static SECStatus SelectClientCert(void *
                              pRetKey);
   if (NULL == *pRetCert) {
     if (NULL == nickname)
-      failf(data, "NSS: client certificate not found (nickname not specified)",
-          nickname);
+      failf(data, "NSS: client certificate not found (nickname not specified)");
     else
       failf(data, "NSS: client certificate not found: %s", nickname);
 
@@ -805,14 +804,14 @@ static SECStatus SelectClientCert(void *
   nickname = (*pRetCert)->nickname;
   if (NULL == nickname)
     nickname = "[unknown]";
-  infof(data, "NSS: using client certificate: %s\n", nickname);
-  display_cert_info(data, *pRetCert);
 
   if (NULL == *pRetKey) {
     failf(data, "NSS: private key not found for certificate: %s", nickname);
     return SECFailure;
   }
 
+  infof(data, "NSS: using client certificate: %s\n", nickname);
+  display_cert_info(data, *pRetCert);
   return rv;
 }