diff --git a/credential.c b/credential.c
index eeeac3242e..d1bb71b41a 100644
--- a/credential.c
+++ b/credential.c
@@ -373,8 +373,7 @@ int credential_from_url_gently(struct credential *c, const char *url,
 
 	if (proto_end - url > 0)
 		c->protocol = xmemdupz(url, proto_end - url);
-	if (slash - host > 0)
-		c->host = url_decode_mem(host, slash - host);
+	c->host = url_decode_mem(host, slash - host);
 	/* Trim leading and trailing slashes from path */
 	while (*slash == '/')
 		slash++;
diff --git a/http.c b/http.c
index a5bd5d62c2..29de6bbb23 100644
--- a/http.c
+++ b/http.c
@@ -524,6 +524,7 @@ static int has_cert_password(void)
 		return 0;
 	if (!cert_auth.password) {
 		cert_auth.protocol = xstrdup("cert");
+		cert_auth.host = xstrdup("");
 		cert_auth.username = xstrdup("");
 		cert_auth.path = xstrdup(ssl_cert);
 		credential_fill(&cert_auth);
diff --git a/t/t0300-credentials.sh b/t/t0300-credentials.sh
index f4c5d7ff91..1c1010bc54 100755
--- a/t/t0300-credentials.sh
+++ b/t/t0300-credentials.sh
@@ -414,4 +414,21 @@ test_expect_success 'url parser ignores embedded newlines' '
 	EOF
 '
 
+test_expect_success 'host-less URLs are parsed as empty host' '
+	check fill "verbatim foo bar" <<-\EOF
+	url=cert:///path/to/cert.pem
+	--
+	protocol=cert
+	host=
+	path=path/to/cert.pem
+	username=foo
+	password=bar
+	--
+	verbatim: get
+	verbatim: protocol=cert
+	verbatim: host=
+	verbatim: path=path/to/cert.pem
+	EOF
+'
+
 test_done