diff --git a/servers/slapd/schema_init.c b/servers/slapd/schema_init.c
index ec9547b3a7..779b9420b5 100644
--- a/servers/slapd/schema_init.c
+++ b/servers/slapd/schema_init.c
@@ -3414,8 +3414,17 @@ certificateExactNormalize(
 			}
 
 			seriallen = snprintf( serialbuf, sizeof(serialbuf), "%llu", sn );
+
+		} else {
+			/* do not accept serialNumber that requires
+			 * more than long long */
+			rc = LDAP_INVALID_SYNTAX;
+			goto done;
 		}
+
 #else
+		/* do not accept serialNumber that requires
+		 * more than long */
 		rc = LDAP_INVALID_SYNTAX;
 		goto done;
 #endif