diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h
index ea0c2cd..9f4160f 100644
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -301,6 +301,10 @@
  * \note           Same as \c mbedtls_x509_crt_verify(), but with explicit
  *                 security profile.
  *
+ * \note           The restrictions on keys (RSA minimum size, allowed curves
+ *                 for ECDSA) only applys to (intermediate) CAs, not to the
+ *                 end-entity certificate.
+ *
  * \param crt      a certificate to be verified
  * \param trust_ca the trusted CA chain
  * \param ca_crl   the CRL chain for trusted CA's