diff --git a/include/mbedtls/ssl_internal.h b/include/mbedtls/ssl_internal.h
index a98a458..826581a 100644
--- a/include/mbedtls/ssl_internal.h
+++ b/include/mbedtls/ssl_internal.h
@@ -382,9 +382,9 @@
  */
 struct mbedtls_ssl_handshake_params
 {
-    /*
-     * Handshake specific crypto variables
-     */
+#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
+    uint8_t got_peer_pubkey;            /*!< Did we store the peer's public key from its certificate? */
+#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     unsigned char verify_cookie_len;    /*!<  Cli: cookie length
                                               Srv: flag for sending a cookie */
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 79d5598..ebc2a63 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -2379,11 +2379,7 @@
     }
 
 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
-    /* Because the peer CRT pubkey is embedded into the handshake
-     * params currently, and there's no 'is_init' functions for PK
-     * contexts, we need to break the abstraction and peek into
-     * the PK context to see if it has been initialized. */
-    if( ssl->handshake->peer_pubkey.pk_info != MBEDTLS_PK_INVALID_HANDLE )
+    if( ssl->handshake->got_peer_pubkey )
         peer_pk = &ssl->handshake->peer_pubkey;
 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
     if( ssl->session_negotiate->peer_cert != NULL )
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index bfd659e..747b9f4 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -4454,15 +4454,10 @@
     /* Skip if we haven't received a certificate from the client.
      * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is set, this can be
      * inferred from the setting of mbedtls_ssl_session::peer_cert.
-     * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is not set, it can
-     * be inferred from whether we've held back the peer CRT's
-     * public key in mbedtls_ssl_handshake_params::peer_pubkey. */
+     * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is not set, it is tracked in a
+     * specific variable. */
 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
-    /* Because the peer CRT pubkey is embedded into the handshake
-     * params currently, and there's no 'is_init' functions for PK
-     * contexts, we need to break the abstraction and peek into
-     * the PK context to see if it has been initialized. */
-    if( ssl->handshake->peer_pubkey.pk_info != MBEDTLS_PK_INVALID_HANDLE )
+    if( ssl->handshake->got_peer_pubkey )
         peer_pk = &ssl->handshake->peer_pubkey;
 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
     if( ssl->session_negotiate->peer_cert != NULL )
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 850bcb1..9810090 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -7357,6 +7357,7 @@
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
+    ssl->handshake->got_peer_pubkey = 1;
     return( 0 );
 }
 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */