--- a/lib/ssl/ssl3con.c
+++ b/lib/ssl/ssl3con.c
@@ -9914,16 +9914,17 @@ ssl3_HandleDHClientKeyExchange(sslSocket
     if (isTLS) target = CKM_TLS_MASTER_KEY_DERIVE_DH;
     else target = CKM_SSL3_MASTER_KEY_DERIVE_DH;
 
     /*  Determine the PMS */
     pms = PK11_PubDerive(serverKey, &clntPubKey, PR_FALSE, NULL, NULL,
                          CKM_DH_PKCS_DERIVE, target, CKA_DERIVE, 0, NULL);
     if (pms == NULL) {
 	ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
+	rv = SECFailure;
 	goto loser;
     }
 
     rv = ssl3_InitPendingCipherSpec(ss,  pms);
     PK11_FreeSymKey(pms); pms = NULL;
 
 loser:
     if (ss->dheKeyPair) {