diff --git a/handshake_server.go b/handshake_server.go
index 020234e..4e8d531 100644
--- a/handshake_server.go
+++ b/handshake_server.go
@@ -281,10 +281,6 @@ func (hs *serverHandshakeState) processClientHello() error {
 		return err
 	}
 
-	if hs.cert != nil {
-		hs.c.localCertificate = hs.cert.Certificate
-	}
-
 	if hs.clientHello.scts {
 		hs.hello.scts = hs.cert.SignedCertificateTimestamps
 	}
@@ -619,6 +615,10 @@ func (hs *serverHandshakeState) doFullHandshake() error {
 
 	certMsg := new(certificateMsg)
 	certMsg.certificates = hs.cert.Certificate
+	// Set localCertificate here, rather than at certificate selection time, so
+	// that it is only populated when a certificate is actually presented to the
+	// peer, and not on resumed connections.
+	c.localCertificate = hs.cert.Certificate
 	if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil {
 		return err
 	}