1diff --git a/lib/tls/mbedtls/mbedtls-server.c b/lib/tls/mbedtls/mbedtls-server.c
2index efd7fc8b..ca5ebc15 100644
3--- a/lib/tls/mbedtls/mbedtls-server.c
4+++ b/lib/tls/mbedtls/mbedtls-server.c
5@@ -39,7 +39,7 @@ lws_tls_server_client_cert_verify_config(struct lws_vhost *vh)
6 	}
7
8 	if (!lws_check_opt(vh->options, LWS_SERVER_OPTION_PEER_CERT_NOT_REQUIRED))
9-		verify_options = SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
10+		verify_options |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
11
12 	lwsl_notice("%s: vh %s requires client cert %d\n", __func__, vh->name,
13 		    verify_options);
14diff --git a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c
15index 3879e977..e47d4c13 100755
16--- a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c
17+++ b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c
18@@ -255,9 +255,9 @@ static int ssl_pm_reload_crt(SSL *ssl)
19     struct pkey_pm *pkey_pm = (struct pkey_pm *)ssl->cert->pkey->pkey_pm;
20     struct x509_pm *crt_pm = (struct x509_pm *)ssl->cert->x509->x509_pm;
21
22-    if (ssl->verify_mode == SSL_VERIFY_PEER)
23+    if ((ssl->verify_mode & SSL_VERIFY_PEER) > 0)
24         mode = MBEDTLS_SSL_VERIFY_REQUIRED;
25-    else if (ssl->verify_mode == SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
26+    else if ((ssl->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) > 0)
27         mode = MBEDTLS_SSL_VERIFY_OPTIONAL;
28     else if (ssl->verify_mode == SSL_VERIFY_CLIENT_ONCE)
29         mode = MBEDTLS_SSL_VERIFY_UNSET;
30@@ -980,9 +980,9 @@ void SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)
31
32 #if defined(LWS_HAVE_mbedtls_ssl_set_hs_authmode)
33
34-	if (ctx->verify_mode == SSL_VERIFY_PEER)
35+	if ((ctx->verify_mode & SSL_VERIFY_PEER) > 0)
36 		mode = MBEDTLS_SSL_VERIFY_REQUIRED;
37-	else if (ctx->verify_mode == SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
38+	else if ((ctx->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) > 0)
39 		mode = MBEDTLS_SSL_VERIFY_REQUIRED;
40 	else if (ctx->verify_mode == SSL_VERIFY_CLIENT_ONCE)
41 		mode = MBEDTLS_SSL_VERIFY_UNSET;
42