diff --git a/src/crypto/x509/root_unix.go b/src/crypto/x509/root_unix.go
index 7bcb3d6..7755293 100644
--- a/src/crypto/x509/root_unix.go
+++ b/src/crypto/x509/root_unix.go
@@ -36,6 +37,8 @@ func loadSystemRoots() (*CertPool, error) {
 		}
 	}
 
+	rootsAdded := false
+
 	for _, directory := range certDirectories {
 		fis, err := ioutil.ReadDir(directory)
 		if err != nil {
@@ -44,16 +47,18 @@ func loadSystemRoots() (*CertPool, error) {
 			}
 			continue
 		}
-		rootsAdded := false
 		for _, fi := range fis {
+			if fi.Mode()&os.ModeSymlink != 0 {
+				continue
+			}
 			data, err := ioutil.ReadFile(directory + "/" + fi.Name())
 			if err == nil && roots.AppendCertsFromPEM(data) {
 				rootsAdded = true
 			}
 		}
-		if rootsAdded {
-			return roots, nil
-		}
+	}
+	if rootsAdded {
+		return roots, nil
 	}
 
 	return nil, firstErr