diff --git a/extensions/extb_ssl.c b/extensions/extb_ssl.c
index 801d4e9b..1e11a755 100644
--- a/extensions/extb_ssl.c
+++ b/extensions/extb_ssl.c
@@ -33,7 +33,18 @@ static int eb_ssl(const char *data, struct Client *client_p,
 
 	(void)chptr;
 	(void)mode_type;
+
+	if (! IsSSLClient(client_p))
+		return EXTBAN_NOMATCH;
+
 	if (data != NULL)
-		return EXTBAN_INVALID;
-	return IsSSLClient(client_p) ? EXTBAN_MATCH : EXTBAN_NOMATCH;
+	{
+		if (EmptyString(client_p->certfp))
+			return EXTBAN_NOMATCH;
+
+		if (strcmp(data, client_p->certfp) != 0)
+			return EXTBAN_NOMATCH;
+	}
+
+	return EXTBAN_MATCH;
 }