diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 5a0bf95a..9814bb39 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -3840,9 +3840,6 @@ tls_pre_decrypt(struct tls_multi *multi,
     }
     else
     {
-        struct tls_session *session = &multi->session[i];
-        struct key_state *ks = &session->key[KS_PRIMARY];
-
         /*
          * Packet must belong to an existing session.
          */
@@ -3856,6 +3853,8 @@ tls_pre_decrypt(struct tls_multi *multi,
             goto error;
         }
 
+        struct tls_session *session = &multi->session[i];
+        struct key_state *ks = &session->key[KS_PRIMARY];
         /*
          * Verify remote IP address
          */