diff --git a/sys/kern/uipc_ktls.c b/sys/kern/uipc_ktls.c
--- a/sys/kern/uipc_ktls.c
+++ b/sys/kern/uipc_ktls.c
@@ -656,6 +656,9 @@
 		}
 		break;
 	case CRYPTO_AES_CBC:
+		if (!ktls_cbc_enable)
+			return (EOPNOTSUPP);
+
 		switch (en->auth_algorithm) {
 		case CRYPTO_SHA1_HMAC:
 			break;
@@ -1301,9 +1304,6 @@
 	if (so->so_rcv.sb_tls_info != NULL)
 		return (EALREADY);
 
-	if (en->cipher_algorithm == CRYPTO_AES_CBC && !ktls_cbc_enable)
-		return (ENOTSUP);
-
 	error = ktls_create_session(so, en, &tls, KTLS_RX);
 	if (error)
 		return (error);
@@ -1387,9 +1387,6 @@
 	if (so->so_snd.sb_tls_info != NULL)
 		return (EALREADY);
 
-	if (en->cipher_algorithm == CRYPTO_AES_CBC && !ktls_cbc_enable)
-		return (ENOTSUP);
-
 	/* TLS requires ext pgs */
 	if (mb_use_ext_pgs == 0)
 		return (ENXIO);