diff --git a/src/security/certstore.cpp b/src/security/certstore.cpp
index 2f70c7b5d8aa768314ddf98ab108204fcb1c2177..6b7dfc42a2e50d9c62fec75bd6d51582506d9c6a 100644
--- a/src/security/certstore.cpp
+++ b/src/security/certstore.cpp
@@ -564,7 +564,7 @@ TrustStore::updateKnownCerts()
 void
 TrustStore::setStoreCertStatus(const crypto::Certificate& crt, TrustStore::PermissionStatus status)
 {
-    if (not crt.isCA())
+    if (not crt.isCA() || not allowed_)
         return;
 
     if (status == PermissionStatus::ALLOWED)
diff --git a/src/sip/sipcall.cpp b/src/sip/sipcall.cpp
index f65c0036a3e17e5c34673c3d559b85a6274741e3..7137c2b3f03cfd5a7e15a570261e9c9a18081e38 100644
--- a/src/sip/sipcall.cpp
+++ b/src/sip/sipcall.cpp
@@ -365,39 +365,30 @@ SIPCall::answer()
 }
 
 void
-SIPCall::hangup(int reason)
-{
-    // Stop all RTP streams
-    stopAllMedia();
-
-    if (not inv or not inv->dlg) {
-        removeCall();
-        throw VoipLinkException("[call:" + getCallId() + "] hangup: no invite session for this call");
-    }
-
-    pjsip_route_hdr *route = inv->dlg->route_set.next;
-    while (route and route != &inv->dlg->route_set) {
-        char buf[1024];
-        int printed = pjsip_hdr_print_on(route, buf, sizeof(buf));
-
-        if (printed >= 0) {
-            buf[printed] = '\0';
-            RING_DBG("[call:%s] Route header %s", getCallId().c_str(), buf);
-        }
-
-        route = route->next;
-    }
-
-    const int status = reason ? reason :
-                       inv->state <= PJSIP_INV_STATE_EARLY and inv->role != PJSIP_ROLE_UAC ?
-                       PJSIP_SC_CALL_TSX_DOES_NOT_EXIST :
-                       inv->state >= PJSIP_INV_STATE_DISCONNECTED ? PJSIP_SC_DECLINE : 0;
-
-    // Notify the peer
-    terminateSipSession(status);
-
-    setState(Call::ConnectionState::DISCONNECTED, reason);
-    removeCall();
+SIPCall::hangup(int reason)
+{
+    if (inv and inv->dlg) {
+        pjsip_route_hdr *route = inv->dlg->route_set.next;
+        while (route and route != &inv->dlg->route_set) {
+            char buf[1024];
+            int printed = pjsip_hdr_print_on(route, buf, sizeof(buf));
+            if (printed >= 0) {
+                buf[printed] = '\0';
+                RING_DBG("[call:%s] Route header %s", getCallId().c_str(), buf);
+            }
+            route = route->next;
+        }
+        const int status = reason ? reason :
+                           inv->state <= PJSIP_INV_STATE_EARLY and inv->role != PJSIP_ROLE_UAC ?
+                           PJSIP_SC_CALL_TSX_DOES_NOT_EXIST :
+                           inv->state >= PJSIP_INV_STATE_DISCONNECTED ? PJSIP_SC_DECLINE : 0;
+        // Notify the peer
+        terminateSipSession(status);
+    }
+    // Stop all RTP streams
+    stopAllMedia();
+    setState(Call::ConnectionState::DISCONNECTED, reason);
+    removeCall();
 }
 
 void