diff --git a/proxy/src/auth/credentials.rs b/proxy/src/auth/credentials.rs
index c5ba8707fc..a1af41d12b 100644
--- a/proxy/src/auth/credentials.rs
+++ b/proxy/src/auth/credentials.rs
@@ -71,14 +71,14 @@ pub(crate) fn endpoint_sni(
     let Some((subdomain, common_name)) = sni.split_once('.') else {
         return Err(ComputeUserInfoParseError::UnknownCommonName { cn: sni.into() });
     };
+    if subdomain == SERVERLESS_DRIVER_SNI || subdomain == SERVERLESS_DRIVER_AUTH_BROKER_SNI {
+        return Ok(None);
+    }
     if !common_names.contains(common_name) {
         return Err(ComputeUserInfoParseError::UnknownCommonName {
             cn: common_name.into(),
         });
     }
-    if subdomain == SERVERLESS_DRIVER_SNI || subdomain == SERVERLESS_DRIVER_AUTH_BROKER_SNI {
-        return Ok(None);
-    }
     Ok(Some(EndpointId::from(subdomain)))
 }