diff --git a/library/x509_crt.c b/library/x509_crt.c
index 76b593852a..14c5ba57c0 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -660,6 +660,11 @@ static int x509_get_subject_key_id(unsigned char **p,
                MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
     }
 
+    if (*p != end) {
+        return MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
+               MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
+    }
+
     return 0;
 }