diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index dabd3420..9b265a4f 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -4191,16 +4191,17 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
             }
 #endif
 
+            alg_k = c->algorithm_mkey;
+            alg_a = c->algorithm_auth;
+
             /* Skip 3DES over TLS v1.0 */
             if (c->algorithm_enc == SSL_3DES &&
-               	(s->version != TLS1_VERSION &&
+                (s->version != TLS1_VERSION &&
                  s->version != DTLS1_VERSION))
                 ok = 0;
             /* not use ECDSA under TLS v1.2 */
             // if ((alg_a & SSL_aECDSA) && s->version != TLS1_2_VERSION) ok = 0;
-
-            alg_k = c->algorithm_mkey;
-            alg_a = c->algorithm_auth;
+            if ((alg_a & SSL_kRSA) && (alg_k & SSL_aRSA) && s->version == TLS1_2_VERSION) ok = 0;
 
 #ifndef OPENSSL_NO_PSK
             /* with PSK there must be server callback set */