diff --git a/ssl/handshake.cc b/ssl/handshake.cc
index a3a38638a..cd6a25df3 100644
--- a/ssl/handshake.cc
+++ b/ssl/handshake.cc
@@ -156,8 +156,9 @@ size_t ssl_max_handshake_message_len(const SSL *ssl) {
     return 1;
   }
 
-  // Clients must accept NewSessionTicket, so allow the default size.
-  return kMaxMessageLen;
+  // Clients must accept NewSessionTicket, so allow the default size or
+  // max_cert_list, whichever is greater.
+  return std::max(kMaxMessageLen, size_t{ssl->max_cert_list});
 }
 
 bool ssl_hash_message(SSL_HANDSHAKE *hs, const SSLMessage &msg) {