diff --git a/lib/hx509/ca.c b/lib/hx509/ca.c
index 977065d02..fd0a21193 100644
--- a/lib/hx509/ca.c
+++ b/lib/hx509/ca.c
@@ -449,7 +449,8 @@ hx509_ca_tbs_set_from_csr(hx509_context context,
     int ret;
 
     if (hx509_request_count_unauthorized(req)) {
-        hx509_set_error_string(context, 0, ENOMEM, "out of memory");
+        hx509_set_error_string(context, 0, EACCES,
+                               "Some certificate features requested in the CSR were not authorized");
         return EACCES;
     }