diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 6f35e58..779ae12 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -2310,8 +2310,8 @@
                                    const int *ciphersuites );
 
 #if defined(MBEDTLS_SSL_CID)
-#define MBEDTLS_SSL_UNEXPECTED_CID_FAIL   0
-#define MBEDTLS_SSL_UNEXPECTED_CID_IGNORE 1
+#define MBEDTLS_SSL_UNEXPECTED_CID_IGNORE 0
+#define MBEDTLS_SSL_UNEXPECTED_CID_FAIL   1
 /**
  * \brief               Specify the length of CIDs for incoming encrypted DTLS
  *                      records and specify the behaviour on unexpected CIDs.