diff --git a/tunnel/tls/server.go b/tunnel/tls/server.go
index f9f66d717..b4a42a868 100644
--- a/tunnel/tls/server.go
+++ b/tunnel/tls/server.go
@@ -102,7 +102,8 @@ func (s *Server) acceptLoop() {
 						}
 					}
 					if s.verifySNI && !matched {
-						return nil, common.NewError("sni mismatched: " + hello.ServerName + ", expected: " + s.sni)
+						expected := sni + " or " + strings.Join(dnsNames, "/")
+						return nil, common.NewError("sni mismatched: " + hello.ServerName + ", expected: " + expected)
 					}
 					return &s.keyPair[0], nil
 				},