diff --git a/native/src/core/cert.rs b/native/src/core/cert.rs
index 57134a95b..b91a4d191 100644
--- a/native/src/core/cert.rs
+++ b/native/src/core/cert.rs
@@ -138,6 +138,9 @@ pub fn read_certificate(fd: RawFd, version: i32) -> Vec<u8> {
 
         Err(bad_apk!("cannot find certificate"))
     }
+    if fd == -1 {
+        return vec![];
+    }
     let mut file = unsafe { File::from_raw_fd(fd) };
     let r = inner(&mut file, version).log().unwrap_or(vec![]);
     std::mem::forget(file);