diff --git a/ssl/test/bssl_shim.cc b/ssl/test/bssl_shim.cc
index 7179832..8daa105 100644
--- a/ssl/test/bssl_shim.cc
+++ b/ssl/test/bssl_shim.cc
@@ -115,6 +115,8 @@
   bool custom_verify_ready = false;
   std::string msg_callback_text;
   bool msg_callback_ok = true;
+  // cert_verified is true if certificate verification has been driven to
+  // completion. This tests that the callback is not called again after this.
   bool cert_verified = false;
 };
 
@@ -716,12 +718,12 @@
     return 0;
   }
 
+  GetTestState(ssl)->cert_verified = true;
   if (config->verify_fail) {
     store_ctx->error = X509_V_ERR_APPLICATION_VERIFICATION;
     return 0;
   }
 
-  GetTestState(ssl)->cert_verified = true;
   return 1;
 }
 
@@ -735,11 +737,11 @@
     return ssl_verify_retry;
   }
 
+  GetTestState(ssl)->cert_verified = true;
   if (config->verify_fail) {
     return ssl_verify_invalid;
   }
 
-  GetTestState(ssl)->cert_verified = true;
   return ssl_verify_ok;
 }