diff --git a/lib/hx509/keyset.c b/lib/hx509/keyset.c
index 6d4902206..0a4bb9613 100644
--- a/lib/hx509/keyset.c
+++ b/lib/hx509/keyset.c
@@ -481,6 +481,10 @@ hx509_certs_find(hx509_context context,
     hx509_certs_end_seq(context, certs, cursor);
     if (ret)
 	return ret;
+    /**
+     * Return HX509_CERT_NOT_FOUND if no certificate in certs matched
+     * the query.
+     */
     if (c == NULL) {
 	hx509_clear_error_string(context);
 	return HX509_CERT_NOT_FOUND;