diff --git a/okhttp/src/main/java/okhttp3/CertificatePinner.java b/okhttp/src/main/java/okhttp3/CertificatePinner.java
index ec5b98c2e7c1..e485c87f52a7 100644
--- a/okhttp/src/main/java/okhttp3/CertificatePinner.java
+++ b/okhttp/src/main/java/okhttp3/CertificatePinner.java
@@ -147,14 +147,14 @@ private CertificatePinner(Builder builder) {
    */
   public void check(String hostname, List<Certificate> peerCertificates)
       throws SSLPeerUnverifiedException {
-    if (trustRootIndex != null) {
-      peerCertificates = new CertificateChainCleaner(trustRootIndex).clean(peerCertificates);
-    }
-
     Set<ByteString> pins = findMatchingPins(hostname);
 
     if (pins == null) return;
 
+    if (trustRootIndex != null) {
+      peerCertificates = new CertificateChainCleaner(trustRootIndex).clean(peerCertificates);
+    }
+
     for (int i = 0, size = peerCertificates.size(); i < size; i++) {
       X509Certificate x509Certificate = (X509Certificate) peerCertificates.get(i);
       if (pins.contains(sha1(x509Certificate))) return; // Success!