diff --git a/lib/hx509/cert.c b/lib/hx509/cert.c
index 27d143849..7096f78c8 100644
--- a/lib/hx509/cert.c
+++ b/lib/hx509/cert.c
@@ -1498,7 +1498,7 @@ hx509_verify_path(hx509_context context,
 		int j;
 
 		if (info.pCPathLenConstraint != NULL &&
-		    *info.pCPathLenConstraint < i + 1)
+		    *info.pCPathLenConstraint < i)
 		{
 		    free_ProxyCertInfo(&info);
 		    ret = HX509_PATH_TOO_LONG;