diff --git a/library/x509_crt.c b/library/x509_crt.c
index fb09253..3652a8c 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -2174,7 +2174,9 @@
     }
 
 exit:
-    /* prevent misuse of the vrfy callback */
+    /* prevent misuse of the vrfy callback - VERIFY_FAILED would be ignored by
+     * the SSL module for authmode optional, but non-zero return from the
+     * callback means a fatal error so it shouldn't be ignored */
     if( ret == POLARSSL_ERR_X509_CERT_VERIFY_FAILED )
         ret = POLARSSL_ERR_X509_FATAL_ERROR;