diff --git a/cmd/sftp-server.go b/cmd/sftp-server.go
index dfb473596..aef9817c8 100644
--- a/cmd/sftp-server.go
+++ b/cmd/sftp-server.go
@@ -161,11 +161,13 @@ internalAuth:
 		return nil, errNoSuchUser
 	}
 
-	if caPublicKey != nil {
+	if caPublicKey != nil && pass == nil {
+
 		err := validateKey(c, key)
 		if err != nil {
 			return nil, errAuthentication
 		}
+
 	} else {
 
 		// Temporary credentials are not allowed.