diff --git a/server/certificates/certificates.go b/server/certificates/certificates.go
index 14f61cb..a8b1c06 100644
--- a/server/certificates/certificates.go
+++ b/server/certificates/certificates.go
@@ -192,13 +192,13 @@ func (c *AcmeClient) retrieveCertFromDB(sni, mainDomainSuffix string, useDnsProv
 	if err != nil {
 		return nil, err
 	}
+	tlsCertificate.Leaf, err = leaf(&tlsCertificate)
+	if err != nil {
+		return nil, err
+	}
 
 	// TODO: document & put into own function
 	if !strings.EqualFold(sni, mainDomainSuffix) {
-		tlsCertificate.Leaf, err = leaf(&tlsCertificate)
-		if err != nil {
-			return nil, err
-		}
 
 		// renew certificates 7 days before they expire
 		if tlsCertificate.Leaf.NotAfter.Before(time.Now().Add(7 * 24 * time.Hour)) {