diff --git a/src/network/ssl/socket.c b/src/network/ssl/socket.c
index 37826a9e7..90a029099 100644
--- a/src/network/ssl/socket.c
+++ b/src/network/ssl/socket.c
@@ -157,7 +157,7 @@ verify_certificates(struct socket *socket)
 	 * only contain ASCII characters.  Internationalized domain
 	 * names must thus be in Punycode form.  Because GnuTLS 2.8.6
 	 * does not itself support IDN, ELinks must convert.  */
-	hostname = get_uri_string(conn->proxied_uri, URI_HOST | URI_IDN);
+	hostname = get_uri_string(conn->proxied_uri, URI_DNS_HOST);
 	if (!hostname) return -6;
 
 	ret = !gnutls_x509_crt_check_hostname(cert, hostname);
@@ -319,7 +319,7 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
 	ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
 	socket = SSL_get_ex_data(ssl, socket_SSL_ex_data_idx);
 	conn = socket->conn;
-	host_in_uri = get_uri_string(conn->proxied_uri, URI_HOST | URI_IDN);
+	host_in_uri = get_uri_string(conn->proxied_uri, URI_DNS_HOST);
 	if (!host_in_uri)
 		return 0;