diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index 67cb778..88f4701 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -650,6 +650,13 @@
 #error "MBEDTLS_SSL_EXTENDED_MASTER_SECRET defined, but not all prerequsites"
 #endif
 
+#if ( defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET) &&            \
+      !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET) ) || \
+    ( !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET) &&           \
+      defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET) )
+#define "MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET and MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET must be defined together."
+#endif
+
 #if defined(MBEDTLS_SSL_TICKET_C) && !defined(MBEDTLS_CIPHER_C)
 #error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites"
 #endif
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 8dcb81c..2116521 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -3444,7 +3444,7 @@
  * This section allows to fix parts of the SSL configuration
  * at compile-time. If a field is fixed at compile-time, the
  * corresponding SSL configuration API `mbedtls_ssl_conf_xxx()`
- * remains present, but takes no effect anymore.
+ * is removed.
  *
  * This can be used on constrained systems to reduce code-size.
  * \{