diff --git a/library/x509_crt.c b/library/x509_crt.c
index a6fcd1b4e6..2309e37de0 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -638,6 +638,11 @@ static int x509_get_authority_key_id(unsigned char **p,
                                  MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
     }
 
+    /* All fields are OPTIONAL, so an empty SEQUENCE is valid. */
+    if (*p == end) {
+        return 0;
+    }
+
     ret = mbedtls_asn1_get_tag(p, end, &len,
                                MBEDTLS_ASN1_CONTEXT_SPECIFIC);