diff --git a/include/polarssl/config.h b/include/polarssl/config.h
index 3a18f8a26..b7d8b6b26 100644
--- a/include/polarssl/config.h
+++ b/include/polarssl/config.h
@@ -331,8 +331,9 @@
  * If set, the X509 parser will not break-off when parsing an X509 certificate
  * and encountering an unknown critical extension.
  *
- * Uncomment to prevent an error.
+ * \warning Depending on your PKI use, enabling this can be a security risk!
  *
+ * Uncomment to prevent an error.
 #define POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
  */