diff --git a/lib/tls.js b/lib/tls.js
index 8650041c91f..1ff0d5d679a 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -140,7 +140,6 @@ function checkServerIdentity(host, cert) {
   //
   // Walk through altnames and generate lists of those names
   if (cert.subjectaltname) {
-    matchCN = false;
     cert.subjectaltname.split(/, /g).forEach(function(altname) {
       if (/^DNS:/.test(altname)) {
         dnsNames.push(altname.slice(4));
@@ -178,7 +177,8 @@ function checkServerIdentity(host, cert) {
 
     if (dnsNames.length > 0) matchCN = false;
 
-    // Match against Common Name (CN) only if altnames are not present.
+    // Match against Common Name (CN) only if no supported identifiers are
+    // present.
     //
     // "As noted, a client MUST NOT seek a match for a reference identifier
     //  of CN-ID if the presented identifiers include a DNS-ID, SRV-ID,