diff --git a/lib/srv/monitor.go b/lib/srv/monitor.go
index 4a834aebc409e..e080d82cdccf7 100644
--- a/lib/srv/monitor.go
+++ b/lib/srv/monitor.go
@@ -256,13 +256,15 @@ func (w *Monitor) start(lockWatch types.Watcher) {
 
 func (w *Monitor) disconnectClientOnExpiredCert() {
 	reason := fmt.Sprintf("client certificate expired at %v", w.Clock.Now().UTC())
-	if err := w.emitDisconnectEvent(reason); err != nil {
-		w.Entry.WithError(err).Warn("Failed to emit audit event.")
-	}
+
 	w.Entry.Debugf("Disconnecting client: %v", reason)
 	if err := w.Conn.Close(); err != nil {
 		w.Entry.WithError(err).Error("Failed to close connection.")
 	}
+
+	if err := w.emitDisconnectEvent(reason); err != nil {
+		w.Entry.WithError(err).Warn("Failed to emit audit event.")
+	}
 }
 
 func (w *Monitor) emitDisconnectEvent(reason string) error {