diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index 3b2fcd82f..9328e51ef 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -8061,7 +8061,7 @@ static int CheckCertSignature_ex(const byte* cert, word32 certSz, void* heap,
                         if (GetSequence(cert, &extIdx, &extLen, certSz) < 0)
                             ret = ASN_PARSE_E;
 
-                        if (ret == 0 && extIdx + 1 < certSz)
+                        if (ret == 0 && (extIdx + 1) >= certSz)
                             ret = BUFFER_E;
 
                         if (ret == 0 &&