diff --git a/CHANGES.md b/CHANGES.md
index 439b86afe..c4691fdf9 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -19,6 +19,8 @@ v3.0.4 - YYYY-MM-DD
 - Fixed a potential buffer overflow in `cupsDNSSDAssembleFullName` on Windows
   (Issue #170)
 - Fixed a potential string overrun when loading .strings files (Issue #171)
+- Fixed `cupsSignCredentialsRequest` to reject requests with a bad signature
+  when using OpenSSL.
 - Fixed an issue with `cupsGetCredentialsTrust` for credentials that are signed
   by an unknown CA.
 - Fixed PAM support in `ippeveprinter`.
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index babf25df9..184685e99 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -1130,7 +1130,7 @@ cupsSignCredentialsRequest(
     return (false);
   }
 
-  if (X509_REQ_verify(crq, X509_REQ_get_pubkey(crq)) < 0)
+  if (X509_REQ_verify(crq, X509_REQ_get_pubkey(crq)) <= 0)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to verify X.509 certificate request."), true);
     goto done;