diff --git a/ChangeLog.txt b/ChangeLog.txt
index c6b2b3fe..cc6f6f52 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -12,6 +12,8 @@ Broker:
   Closes #886.
 - All clients now time out if they exceed their keepalive*1.5, rather than
   just reach it. This was inconsistent in two places.
+- Fix segfault on startup if bridge CA certificates could not be read.
+  Closes #851.
 
 Library:
 - Fix some places where return codes were incorrect, including to the
diff --git a/lib/net_mosq.c b/lib/net_mosq.c
index 891d231a..c6f2561e 100644
--- a/lib/net_mosq.c
+++ b/lib/net_mosq.c
@@ -639,10 +639,12 @@ int net__socket_connect(struct mosquitto *mosq, const char *host, uint16_t port,
 	rc = net__try_connect(mosq, host, port, &sock, bind_address, blocking);
 	if(rc > 0) return rc;
 
-	mosq->sock = sock;
 	rc = net__socket_connect_step3(mosq, host, port, bind_address, blocking);
+	if(rc) return rc;
 
-	return rc;
+	mosq->sock = sock;
+
+	return MOSQ_ERR_SUCCESS;
 }