diff --git a/src/internal.c b/src/internal.c
index 029ae655b..91411de3c 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -16711,7 +16711,7 @@ static WC_INLINE int VerifyMac(WOLFSSL* ssl, const byte* input, word32 msgSz,
         padByte = 1;
 
         if (ssl->options.tls) {
-#if defined(HAVE_PK_CALLBACKS)
+#if !defined(NO_CERTS) && defined(HAVE_PK_CALLBACKS)
             ret = PROTOCOLCB_UNAVAILABLE;
             if(ssl->ctx->VerifymacCb) {
                 void* ctx = wolfSSL_GetVerifymacCtx(ssl);
diff --git a/src/keys.c b/src/keys.c
index 5831b8595..8a8a9cb73 100644
--- a/src/keys.c
+++ b/src/keys.c
@@ -3119,7 +3119,8 @@ int SetKeysSide(WOLFSSL* ssl, enum encrypt_side side)
     else
 #endif
 
-#if defined(HAVE_PK_CALLBACKS)
+#if !defined(NO_CERTS) && defined(HAVE_PK_CALLBACKS)
+    ret = PROTOCOLCB_UNAVAILABLE;
     if (ssl->ctx->SetKeysCb) {
         void* ctx = wolfSSL_GetSetKeysCtx(ssl);
         ret = ssl->ctx->SetKeysCb(ssl, ctx);
diff --git a/src/tls.c b/src/tls.c
index 32cac7352..c59f7e82f 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -210,7 +210,7 @@ int BuildTlsFinished(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
             side = tls_server;
 
 #ifdef WOLFSSL_HAVE_PRF
-#if defined(HAVE_PK_CALLBACKS)
+#if !defined(NO_CERTS) && defined(HAVE_PK_CALLBACKS)
         if (ssl->ctx->TlsFinishedCb) {
             void* ctx = wolfSSL_GetTlsFinishedCtx(ssl);
             ret = ssl->ctx->TlsFinishedCb(ssl, side, handshake_hash, 
@@ -401,7 +401,7 @@ int DeriveTlsKeys(WOLFSSL* ssl)
         ret = tsip_generateSeesionKey(ssl);
     else {
 #endif
-#if defined(HAVE_PK_CALLBACKS)
+#if !defined(NO_CERTS) && defined(HAVE_PK_CALLBACKS)
         ret = PROTOCOLCB_UNAVAILABLE;
         if (ssl->ctx->GenSessionKeyCb) {
             void* ctx = wolfSSL_GetGenSesssionKeyCtx(ssl);
@@ -593,7 +593,7 @@ int MakeTlsMasterSecret(WOLFSSL* ssl)
             #endif
         } else
 #endif
-#if defined(HAVE_PK_CALLBACKS)
+#if !defined(NO_CERTS) && defined(HAVE_PK_CALLBACKS)
         ret = PROTOCOLCB_UNAVAILABLE;
         if (ssl->ctx->GenMasterCb) {
             void* ctx = wolfSSL_GetGenMasterSecretCtx(ssl);
diff --git a/wolfssl/test.h b/wolfssl/test.h
index 9c8badec5..19a1eea5d 100644
--- a/wolfssl/test.h
+++ b/wolfssl/test.h
@@ -4768,6 +4768,7 @@ static WC_INLINE void SetupPkCallbacks(WOLFSSL_CTX* ctx)
         wolfSSL_CTX_SetRsaDecCb(ctx, myRsaDec);
     #endif /* NO_RSA */
     
+    #ifndef NO_CERTS
     wolfSSL_CTX_SetGenMasterSecretCb(ctx, myGenMaster);
     wolfSSL_CTX_SetGenPreMasterCb(ctx, myGenPreMaster);
     wolfSSL_CTX_SetGenSesssionKeyCb(ctx, myGenSessionKey);
@@ -4778,6 +4779,7 @@ static WC_INLINE void SetupPkCallbacks(WOLFSSL_CTX* ctx)
     #endif
     
     wolfSSL_CTX_SetTlsFinishedCb(ctx, myTlsFinished);
+    #endif /* NO_CERTS */
 }
 
 static WC_INLINE void SetupPkCallbackContexts(WOLFSSL* ssl, void* myCtx)
@@ -4818,6 +4820,7 @@ static WC_INLINE void SetupPkCallbackContexts(WOLFSSL* ssl, void* myCtx)
         wolfSSL_SetRsaDecCtx(ssl, myCtx);
     #endif /* NO_RSA */
     
+    #ifndef NO_CERTS
     wolfSSL_SetGenMasterSecretCtx(ssl, myCtx);
     wolfSSL_SetGenPreMasterCtx(ssl, myCtx);
     wolfSSL_SetGenSesssionKeyCtx(ssl, myCtx);
@@ -4828,6 +4831,7 @@ static WC_INLINE void SetupPkCallbackContexts(WOLFSSL* ssl, void* myCtx)
     #endif
     
     wolfSSL_SetTlsFinishedCtx(ssl, myCtx);
+    #endif
 }
 
 #endif /* HAVE_PK_CALLBACKS */