diff --git a/lib/jose/jwe/jwe-rsa-aescbc.c b/lib/jose/jwe/jwe-rsa-aescbc.c
index a46df34be..545471552 100644
--- a/lib/jose/jwe/jwe-rsa-aescbc.c
+++ b/lib/jose/jwe/jwe-rsa-aescbc.c
@@ -178,12 +178,18 @@ lws_jwe_auth_and_decrypt_rsa_aes_cbc_hs(struct lws_jwe *jwe)
 		return -1;
 	}
 
+#if defined(LWS_WITH_MBEDTLS) && defined(LWS_PLAT_OPTEE)
+
 	/* strip padding */
 
 	n = jwe->jws.map.buf[LJWE_CTXT][jwe->jws.map.len[LJWE_CTXT] - 1];
-	if (n > 16)
+	if (n > 16) {
+		lwsl_err("%s: n == %d, plen %d\n", __func__, n,
+				(int)jwe->jws.map.len[LJWE_CTXT]);
 		return -1;
+	}
 	jwe->jws.map.len[LJWE_CTXT] -= n;
+#endif
 
 	return jwe->jws.map.len[LJWE_CTXT];
 }