diff --git a/proxmox/src/tools/tfa/u2f.rs b/proxmox/src/tools/tfa/u2f.rs
index 1a7d8481..42339155 100644
--- a/proxmox/src/tools/tfa/u2f.rs
+++ b/proxmox/src/tools/tfa/u2f.rs
@@ -45,7 +45,7 @@ pub struct Registration {
     /// Attestation certificate (in DER format) from which we originally copied the `key_handle`.
     /// Not necessary for authentication, unless the hardware tokens should be restricted to
     /// specific provider identities. Optional.
-    #[serde(with = "bytes_as_base64")]
+    #[serde(with = "bytes_as_base64", default, skip_serializing_if = "Vec::is_empty")]
     pub certificate: Vec<u8>,
 }