diff --git a/irc/accounts.go b/irc/accounts.go
index 5b5540ed..0012d385 100644
--- a/irc/accounts.go
+++ b/irc/accounts.go
@@ -378,9 +378,6 @@ func (am *AccountManager) Register(client *Client, account string, callbackNames
 			tx.Set(registeredTimeKey, registeredTimeStr, setOptions)
 			tx.Set(credentialsKey, credStr, setOptions)
 			tx.Set(callbackKey, callbackSpec, setOptions)
-			if certfp != "" {
-				tx.Set(certFPKey, casefoldedAccount, setOptions)
-			}
 			return nil
 		})
 	}()
@@ -1439,6 +1436,13 @@ func (ac *AccountCredentials) SetPassphrase(passphrase string, bcryptCost uint)
 }
 
 func (ac *AccountCredentials) AddCertfp(certfp string) (err error) {
+	// XXX we require that certfp is already normalized (rather than normalize here
+	// and pass back the normalized version as an additional return parameter);
+	// this is just a final sanity check:
+	if len(certfp) != 64 {
+		return utils.ErrInvalidCertfp
+	}
+
 	for _, current := range ac.Certfps {
 		if certfp == current {
 			return errNoop