--- xen-4.3.0/tools/qemu-xen/ui/vnc-ws.c
+++ xen-4.3.0.mod/tools/qemu-xen/ui/vnc-ws.c
@@ -90,11 +90,6 @@
     vncws_tls_handshake(vs);
 }
 
-#define NEED_X509_AUTH(vs)                              \
-    ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE ||   \
-     (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC ||    \
-     (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN ||  \
-     (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL)
 #endif
 
 void vncws_handshake_read(void *opaque)
@@ -105,7 +100,7 @@
     if (!vs->vd->want_tls)
         return vncws_handshake_read_impl(vs);
 
-    if (vnc_tls_client_setup(vs, NEED_X509_AUTH(vs)) < 0) {
+    if (vnc_tls_client_setup(vs, true) < 0) {
         VNC_DEBUG("Failed to setup TLS\n");
         return 0;
     }
--- xen-4.3.0/tools/qemu-xen/ui/vnc.c
+++ xen-4.3.0.mod/tools/qemu-xen/ui/vnc.c
@@ -3121,7 +3121,11 @@
      */
     if (password) {
 #ifdef CONFIG_VNC_TLS
+#ifdef CONFIG_VNC_WS
+        if (tls && !vs->websocket) {
+#else
         if (tls) {
+#endif
             vs->auth = VNC_AUTH_VENCRYPT;
             if (x509) {
                 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
@@ -3141,7 +3145,11 @@
 #ifdef CONFIG_VNC_SASL
     } else if (sasl) {
 #ifdef CONFIG_VNC_TLS
+#ifdef CONFIG_VNC_WS
+        if (tls && !vs->websocket) {
+#else
         if (tls) {
+#endif
             vs->auth = VNC_AUTH_VENCRYPT;
             if (x509) {
                 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
@@ -3161,7 +3169,11 @@
 #endif /* CONFIG_VNC_SASL */
     } else {
 #ifdef CONFIG_VNC_TLS
+#ifdef CONFIG_VNC_WS
+        if (tls && !vs->websocket) {
+#else
         if (tls) {
+#endif
             vs->auth = VNC_AUTH_VENCRYPT;
             if (x509) {
                 VNC_DEBUG("Initializing VNC server with x509 no auth\n");