diff --git a/sm/ChangeLog b/sm/ChangeLog
index e543bbcba..30c3d53df 100644
--- a/sm/ChangeLog
+++ b/sm/ChangeLog
@@ -1,3 +1,8 @@
+2004-02-24  Werner Koch  <wk@gnupg.org>
+
+	* keylist.c (list_cert_colon): Print the fingerprint as the
+	cert-id for root certificates.
+
 2004-02-21  Werner Koch  <wk@gnupg.org>
 
 	* keylist.c (list_internal_keys): Return error codes.
diff --git a/sm/keylist.c b/sm/keylist.c
index 3ebbe3ba3..6d48068b0 100644
--- a/sm/keylist.c
+++ b/sm/keylist.c
@@ -249,21 +249,27 @@ list_cert_colon (ctrl_t ctrl, ksba_cert_t cert, unsigned int validity,
 
   /* FPR record */
   fprintf (fp, "fpr:::::::::%s:::", fpr);
-  xfree (fpr); fpr = NULL;
   /* print chaining ID (field 13)*/
   {
     ksba_cert_t next;
+    int rc;
     
-    if (!gpgsm_walk_cert_chain (cert, &next))
+    rc = gpgsm_walk_cert_chain (cert, &next);
+    if (!rc) /* We known the issuer's certificate. */
       {
         p = gpgsm_get_fingerprint_hexstring (next, GCRY_MD_SHA1);
         fputs (p, fp);
         xfree (p);
         ksba_cert_release (next);
       }
+    else if (rc == -1)  /* We reached the root certificate. */
+      {
+        fputs (fpr, fp);
+      }
   }
   putc (':', fp);
   putc ('\n', fp);
+  xfree (fpr); fpr = NULL;
 
 
   if (opt.with_key_data)