diff --git a/src/GatewayAuth/Implementations/CertificateSignatureValidator.cs b/src/GatewayAuth/Implementations/CertificateSignatureValidator.cs
index a82a3de..5f40214 100644
--- a/src/GatewayAuth/Implementations/CertificateSignatureValidator.cs
+++ b/src/GatewayAuth/Implementations/CertificateSignatureValidator.cs
@@ -15,6 +15,9 @@ internal sealed class CertificateSignatureValidator : ISignatureValidator
     {
         if (_rsa is not null) return;
 
+        if (string.IsNullOrWhiteSpace(options.Certificate))
+            throw new InvalidOperationException("Certificate is null or whitespace");
+
         var certificate = new X509Certificate2(Encoding.ASCII.GetBytes(options.Certificate));
         _rsa = certificate.GetRSAPublicKey() ?? throw new InvalidOperationException("Could not get RSA public key from certificate");
     }
diff --git a/src/GatewayAuth/Options/PostConfigureOptions.cs b/src/GatewayAuth/Options/PostConfigureOptions.cs
index 5311371..9bba739 100644
--- a/src/GatewayAuth/Options/PostConfigureOptions.cs
+++ b/src/GatewayAuth/Options/PostConfigureOptions.cs
@@ -14,9 +14,6 @@ public sealed class PostConfigureOptions : IPostConfigureOptions<GatewayAuthOpti
 
     public void PostConfigure(string? name, GatewayAuthOptions options)
     {
-        if (options.Certificate == null)
-            throw new InvalidOperationException("Certificate is null");
-
         _signatureValidator.Initialize(options);
     }
 }