diff --git a/include/polarssl/config.h b/include/polarssl/config.h
index 422c8be95..21aa9fa6a 100644
--- a/include/polarssl/config.h
+++ b/include/polarssl/config.h
@@ -1157,6 +1157,8 @@
  * If set, the X509 parser will not break-off when parsing an X509 certificate
  * and encountering an unknown critical extension.
  *
+ * \warning Depending on your PKI use, enabling this can be a security risk!
+ *
  * Uncomment to prevent an error.
  */
 //#define POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION