--- a/src/libdnssec/key/key.c
+++ b/src/libdnssec/key/key.c
@@ -146,10 +146,14 @@ dnssec_key_t *dnssec_key_dup(const dnsse
 
 		gnutls_privkey_type_t type = gnutls_privkey_get_type(key->private_key);
 		if (type == GNUTLS_PRIVKEY_PKCS11) {
+#ifdef ENABLE_PKCS11
 			gnutls_pkcs11_privkey_t tmp;
 			gnutls_privkey_export_pkcs11(key->private_key, &tmp);
 			gnutls_privkey_import_pkcs11(dup->private_key, tmp,
 			                             GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE);
+#else
+			assert(0);
+#endif
 		} else {
 			assert(type == GNUTLS_PRIVKEY_X509);
 			gnutls_x509_privkey_t tmp;