diff --git a/Lib/ssl.py b/Lib/ssl.py
index a634442e13c..e83d889cddd 100644
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@ -125,6 +125,8 @@ def __init__(self, sock=None, keyfile=None, certfile=None,
             if server_side and not certfile:
                 raise ValueError("certfile must be specified for server-side "
                                  "operations")
+            if keyfile and not certfile:
+                raise ValueError("certfile must be specified")
             if certfile and not keyfile:
                 keyfile = certfile
             self.context = SSLContext(ssl_version)
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index a3d1df13808..8e38ae04c13 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -174,19 +174,24 @@ def test_timeout(self):
 
     def test_errors(self):
         sock = socket.socket()
-        with self.assertRaisesRegexp(ValueError, "certfile must be specified"):
-            ssl.wrap_socket(sock, server_side=True)
-            ssl.wrap_socket(sock, server_side=True, certfile="")
+        self.assertRaisesRegexp(ValueError,
+                        "certfile must be specified",
+                        ssl.wrap_socket, sock, keyfile=CERTFILE)
+        self.assertRaisesRegexp(ValueError,
+                        "certfile must be specified for server-side operations",
+                        ssl.wrap_socket, sock, server_side=True)
+        self.assertRaisesRegexp(ValueError,
+                        "certfile must be specified for server-side operations",
+                        ssl.wrap_socket, sock, server_side=True, certfile="")
         s = ssl.wrap_socket(sock, server_side=True, certfile=CERTFILE)
         self.assertRaisesRegexp(ValueError, "can't connect in server-side mode",
                                 s.connect, (HOST, 8080))
         with self.assertRaises(IOError) as cm:
             ssl.wrap_socket(socket.socket(), certfile=WRONGCERT)
         self.assertEqual(cm.exception.errno, errno.ENOENT)
-        # XXX - temporarily disabled as per issue #9711
-        #with self.assertRaises(IOError) as cm:
-        #    ssl.wrap_socket(socket.socket(), keyfile=WRONGCERT)
-        #self.assertEqual(cm.exception.errno, errno.ENOENT)
+        with self.assertRaises(IOError) as cm:
+            ssl.wrap_socket(socket.socket(), certfile=CERTFILE, keyfile=WRONGCERT)
+        self.assertEqual(cm.exception.errno, errno.ENOENT)
         with self.assertRaises(IOError) as cm:
             ssl.wrap_socket(socket.socket(), certfile=WRONGCERT, keyfile=WRONGCERT)
         self.assertEqual(cm.exception.errno, errno.ENOENT)