diff --git a/mongoose.c b/mongoose.c
index 9c98cbd5..af9258d5 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -20305,7 +20305,7 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
           bool is_addr = mg_aton_(mg_str_s(tls->hostname), &addr);
           if (mg_tls_verify_cert_san(cert, certsz, tls->hostname,
                                      is_addr ? &addr : NULL) <= 0 &&
-              (!is_addr ||  // DNS CN fallback
+              (is_addr ||  // IP references require a matching SAN
                mg_tls_verify_cert_cn(&ci->subj, tls->hostname) <= 0)) {
             mg_error(c, "failed to verify hostname");
             return -1;
diff --git a/src/tls_builtin.c b/src/tls_builtin.c
index 78193cc7..c57a5e61 100644
--- a/src/tls_builtin.c
+++ b/src/tls_builtin.c
@@ -1904,7 +1904,7 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
           bool is_addr = mg_aton_(mg_str_s(tls->hostname), &addr);
           if (mg_tls_verify_cert_san(cert, certsz, tls->hostname,
                                      is_addr ? &addr : NULL) <= 0 &&
-              (!is_addr ||  // DNS CN fallback
+              (is_addr ||  // IP references require a matching SAN
                mg_tls_verify_cert_cn(&ci->subj, tls->hostname) <= 0)) {
             mg_error(c, "failed to verify hostname");
             return -1;