diff --git a/internal/web/tenant_tls/tenant_tls.go b/internal/web/tenant_tls/tenant_tls.go
index f2212553d..d32f17283 100644
--- a/internal/web/tenant_tls/tenant_tls.go
+++ b/internal/web/tenant_tls/tenant_tls.go
@@ -78,5 +78,8 @@ func (w *Watcher) GetCertificate(ch *tls.ClientHelloInfo) (*tls.Certificate, err
 		return w.fallback, nil
 	}
 	cert := w.cs.Get(*bestSelection.WebCertificate.Get())
+	if cert == nil {
+		return w.fallback, nil
+	}
 	return cert, nil
 }