diff --git a/src/internal.c b/src/internal.c
index e7ec629ca..7ab3f1b72 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -12425,7 +12425,12 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
             }
 
         #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
-            if (args->untrustedDepth > ssl->options.verifyDepth) {
+           /* limit compliant with OpenSSL verify Depth + 1
+            * OpenSSL tries to expand the chain one longer than limit until
+            * reaching an ultimately trusted issuer. Becoming failure if
+            * we hit the limit, with X509_V_ERR_CERT_CHAIN_TOO_LONG
+            */
+            if (args->untrustedDepth > (ssl->options.verifyDepth + 1)) {
                 ssl->peerVerifyRet = X509_V_ERR_CERT_CHAIN_TOO_LONG;
                 ret = MAX_CHAIN_ERROR;
             }
diff --git a/tests/api.c b/tests/api.c
index 4ab15cb31..0e1f02b49 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -5101,8 +5101,8 @@ static void test_wolfSSL_CTX_verifyDepth_ServerClient(void)
         client_args.argc = -1;
         test_client_verifyDepth(&client_args);
         join_thread(serverThread);
-        AssertIntEQ(client_args.return_code, TEST_FAIL);
-        AssertIntEQ(server_args.return_code, TEST_FAIL);
+        AssertIntEQ(client_args.return_code, TEST_SUCCESS);
+        AssertIntEQ(server_args.return_code, TEST_SUCCESS);
     }
     
     FreeTcpReady(&ready);