diff --git a/core/subscription.c b/core/subscription.c
index 67648a01..272e5f8e 100644
--- a/core/subscription.c
+++ b/core/subscription.c
@@ -395,6 +395,7 @@ end:
 }
 
 static int subscription_new_sign_ctx(struct uwsgi_subscribe_slot *, struct uwsgi_subscribe_req *);
+static int subscription_is_safe(struct uwsgi_subscribe_req *);
 
 struct uwsgi_subscribe_node *uwsgi_add_subscribe_node(struct uwsgi_subscribe_slot **slot, struct uwsgi_subscribe_req *usr) {
 
@@ -420,7 +421,7 @@ struct uwsgi_subscribe_node *uwsgi_add_subscribe_node(struct uwsgi_subscribe_slo
 			if (!uwsgi_strncmp(node->name, node->len, usr->address, usr->address_len)) {
 #ifdef UWSGI_SSL
 				// this should avoid sending sniffed packets...
-				if (current_slot->sign_ctx && usr->unix_check <= node->unix_check) {
+				if (current_slot->sign_ctx && !subscription_is_safe(usr) && usr->unix_check <= node->unix_check) {
 					uwsgi_log("[uwsgi-subscription for pid %d] invalid (sniffed ?) packet sent for slot: %.*s node: %.*s unix_check: %lu\n", (int) uwsgi.mypid, usr->keylen, usr->key, usr->address_len, usr->address, (unsigned long) usr->unix_check);
 					return NULL;
 				}
@@ -441,6 +442,10 @@ struct uwsgi_subscribe_node *uwsgi_add_subscribe_node(struct uwsgi_subscribe_slo
 		}
 
 #ifdef UWSGI_SSL
+		if (current_slot->sign_ctx && !subscription_is_safe(usr) && usr->unix_check < (uwsgi_now() - (time_t) uwsgi.subscriptions_sign_check_tolerance)) {
+			uwsgi_log("[uwsgi-subscription for pid %d] invalid (sniffed ?) packet sent for slot: %.*s node: %.*s unix_check: %lu\n", (int) uwsgi.mypid, usr->keylen, usr->key, usr->address_len, usr->address, (unsigned long) usr->unix_check);
+                        return NULL;
+		}
 		// check here as we are sure the node will be added
 		uwsgi_subscription_sni_check(current_slot, usr);
 #endif
diff --git a/plugins/corerouter/cr_common.c b/plugins/corerouter/cr_common.c
index a945723f..8c14f5a8 100644
--- a/plugins/corerouter/cr_common.c
+++ b/plugins/corerouter/cr_common.c
@@ -154,10 +154,6 @@ void uwsgi_corerouter_manage_subscription(struct uwsgi_corerouter *ucr, int id,
 			if (node && node->len) {
 #ifdef UWSGI_SSL
 				if (uwsgi.subscriptions_sign_check_dir) {
-					if (usr.sign_len == 0 || usr.base_len == 0)
-						return;
-					if (usr.unix_check <= node->unix_check)
-						return;
 					if (!uwsgi_subscription_sign_check(node->slot, &usr)) {
 						return;
 					}