diff --git a/lib/polarssl.c b/lib/polarssl.c
index e81e660..991ba7e 100644
--- a/lib/polarssl.c
+++ b/lib/polarssl.c
@@ -258,21 +258,27 @@ Curl_polarssl_connect(struct connectdata *conn,
   ret = ssl_get_verify_result(&conn->ssl[sockindex].ssl);
 
   if(ret && data->set.ssl.verifypeer) {
+    const char *err=NULL;
     if(ret & BADCERT_EXPIRED)
-      failf(data, "Cert verify failed: BADCERT_EXPIRED\n");
-
-    if(ret & BADCERT_REVOKED)
-      failf(data, "Cert verify failed: BADCERT_REVOKED");
-
-    if(ret & BADCERT_CN_MISMATCH)
-      failf(data, "Cert verify failed: BADCERT_CN_MISMATCH");
-
-    if(ret & BADCERT_NOT_TRUSTED)
-      failf(data, "Cert verify failed: BADCERT_NOT_TRUSTED");
+      err="Expired";
+    else if(ret & BADCERT_REVOKED)
+      err="Revoked";
+    else if(ret & BADCERT_NOT_TRUSTED)
+      err="Not Trusted";
+
+    if(err) {
+      failf(data, "Certificate verification failed: %s", err);
+      return CURLE_PEER_FAILED_VERIFICATION;
+    }
+  }
 
-    return CURLE_SSL_CACERT;
+  if((ret & BADCERT_CN_MISMATCH) && data->set.ssl.verifyhost) {
+    failf(data, "SSL: certificate subject name does not match target"
+          "host name '%s'", conn->host.dispname);
+    return CURLE_PEER_FAILED_VERIFICATION;
   }
 
+
   if(conn->ssl[sockindex].ssl.peer_cert) {
     /* If the session was resumed, there will be no peer certs */
     memset(buffer, 0, sizeof(buffer));