diff --git a/library/x509_crt.c b/library/x509_crt.c
index 525d250..5273c3a 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -481,6 +481,10 @@
             continue;
         }
 
+        /* Forbid repeated extensions */
+        if( ( crt->ext_types & ext_type ) != 0 )
+            return( POLARSSL_ERR_X509_INVALID_EXTENSIONS );
+
         crt->ext_types |= ext_type;
 
         switch( ext_type )