diff --git a/irc.el b/irc.el
index 3fd865e..32a8417 100644
--- a/irc.el
+++ b/irc.el
@@ -107,7 +107,10 @@ COMMAND conn sender args... -- An IRC command message was received"
                        :keepalive t)))
     (when (and (plist-get keywords :tls)
                (fboundp 'nsm-verify-connection))
-      (setq proc (nsm-verify-connection proc host service))
+      ;; gnutls-verify-error must be nil for nsm to work, otherwise
+      ;; keep it at the default value (see #405)
+      (let (gnutls-verify-error)
+        (setq proc (nsm-verify-connection proc host service)))
       (when (not proc)
         (error "nsm verification failed")))
     ;; When we used `make-network-process' without :nowait, the
diff --git a/tests/manual/test-nsm.el b/tests/manual/test-nsm.el
new file mode 100644
index 0000000..9dade90
--- /dev/null
+++ b/tests/manual/test-nsm.el
@@ -0,0 +1,5 @@
+;; see #405
+(require 'circe)
+(setq gnutls-verify-error t)
+
+(irc-connect :host "expired.badssl.com" :service 443 :tls t)