diff --git a/ChangeLog.d/build-without-certs.txt b/ChangeLog.d/build-without-certs.txt
new file mode 100644
index 0000000..dcb5c77
--- /dev/null
+++ b/ChangeLog.d/build-without-certs.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Fix build errors in test programs when MBEDTLS_CERTS_C is disabled.
+     Fixes #6243.
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index dd78c0b..dce1cbb 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -2358,7 +2358,7 @@
 #if !defined(MBEDTLS_CERTS_C)
         mbedtls_printf("Not certificated or key provided, and \nMBEDTLS_CERTS_C not defined!\n");
         goto exit;
-#else
+#else /* MBEDTLS_CERTS_C */
 #if defined(MBEDTLS_RSA_C)
         if ((ret = mbedtls_x509_crt_parse(&srvcert,
                                           (const unsigned char *) mbedtls_test_srv_crt_rsa,
@@ -2393,6 +2393,7 @@
         }
         key_cert_init2 = 2;
 #endif /* MBEDTLS_ECDSA_C */
+#endif /* MBEDTLS_CERTS_C */
     }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -2418,7 +2419,6 @@
         }
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
-#endif /* MBEDTLS_CERTS_C */
 
         mbedtls_printf(" ok (key types: %s - %s)\n",
                        mbedtls_pk_get_name(&pkey),