diff --git a/libnm-core/nm-setting-vpn.c b/libnm-core/nm-setting-vpn.c
index 79a7350bdb..339f2d47a7 100644
--- a/libnm-core/nm-setting-vpn.c
+++ b/libnm-core/nm-setting-vpn.c
@@ -713,17 +713,15 @@ need_secrets (NMSetting *setting)
 }
 
 static gboolean
-compare_one_secret (NMSettingVpn *a,
-                    NMSettingVpn *b,
-                    NMSettingCompareFlags flags)
+_compare_secrets (NMSettingVpn *a,
+                  NMSettingVpn *b,
+                  NMSettingCompareFlags flags)
 {
-	GHashTable *a_secrets, *b_secrets;
+	GHashTable *a_secrets;
 	GHashTableIter iter;
 	const char *key, *val;
 
 	a_secrets = NM_SETTING_VPN_GET_PRIVATE (a)->secrets;
-	b_secrets = NM_SETTING_VPN_GET_PRIVATE (b)->secrets;
-
 	g_hash_table_iter_init (&iter, a_secrets);
 	while (g_hash_table_iter_next (&iter, (gpointer) &key, (gpointer) &val)) {
 		NMSettingSecretFlags a_secret_flags = NM_SETTING_SECRET_FLAG_NONE;
@@ -752,6 +750,19 @@ compare_one_secret (NMSettingVpn *a,
 	return TRUE;
 }
 
+static gboolean
+compare_one_secret (NMSettingVpn *a,
+                    NMSettingVpn *b,
+                    NMSettingCompareFlags flags)
+{
+	if (!_compare_secrets (a, b, flags))
+		return FALSE;
+	if (!_compare_secrets (b, a, flags))
+		return FALSE;
+
+	return TRUE;
+}
+
 static gboolean
 compare_property (NMSetting *setting,
                   NMSetting *other,
diff --git a/libnm-util/nm-setting-vpn.c b/libnm-util/nm-setting-vpn.c
index f0d7ecf511..e47fe3949c 100644
--- a/libnm-util/nm-setting-vpn.c
+++ b/libnm-util/nm-setting-vpn.c
@@ -616,17 +616,15 @@ need_secrets (NMSetting *setting)
 }
 
 static gboolean
-compare_one_secret (NMSettingVPN *a,
-                    NMSettingVPN *b,
-                    NMSettingCompareFlags flags)
+_compare_secrets (NMSettingVPN *a,
+                  NMSettingVPN *b,
+                  NMSettingCompareFlags flags)
 {
-	GHashTable *a_secrets, *b_secrets;
+	GHashTable *a_secrets;
 	GHashTableIter iter;
 	const char *key, *val;
 
 	a_secrets = NM_SETTING_VPN_GET_PRIVATE (a)->secrets;
-	b_secrets = NM_SETTING_VPN_GET_PRIVATE (b)->secrets;
-
 	g_hash_table_iter_init (&iter, a_secrets);
 	while (g_hash_table_iter_next (&iter, (gpointer) &key, (gpointer) &val)) {
 		NMSettingSecretFlags a_secret_flags = NM_SETTING_SECRET_FLAG_NONE;
@@ -655,6 +653,19 @@ compare_one_secret (NMSettingVPN *a,
 	return TRUE;
 }
 
+static gboolean
+compare_one_secret (NMSettingVPN *a,
+                    NMSettingVPN *b,
+                    NMSettingCompareFlags flags)
+{
+	if (!_compare_secrets (a, b, flags))
+		return FALSE;
+	if (!_compare_secrets (b, a, flags))
+		return FALSE;
+
+	return TRUE;
+}
+
 static gboolean
 compare_property (NMSetting *setting,
                   NMSetting *other,