diff --git a/src/sniffer.c b/src/sniffer.c
index 227355c6c..e4d0210ed 100644
--- a/src/sniffer.c
+++ b/src/sniffer.c
@@ -2347,9 +2347,17 @@ static int ProcessCertificate(const byte* input, int* sslBytes,
     ret = WatchCb((void*)session, digest, sizeof(digest), input, certSz,
             WatchCbCtx, error);
     if (ret != 0) {
+#ifdef WOLFSSL_SNIFFER_STATS
+        INC_STAT(SnifferStats.sslKeysUnmatched);
+#endif
         SetError(WATCH_FAIL_STR, error, session, FATAL_ERROR_STATE);
         return -1;
     }
+    else {
+#ifdef WOLFSSL_SNIFFER_STATS
+        INC_STAT(SnifferStats.sslKeyMatches);
+#endif
+    }
 
     return 0;
 }