diff --git a/crypto.go b/crypto.go
index 14e1db0..e6d6d5f 100644
--- a/crypto.go
+++ b/crypto.go
@@ -93,7 +93,11 @@ func (i *Identity) ConfigForPeer(remote peer.ID) (*tls.Config, <-chan ic.PubKey)
 			return err
 		}
 		if remote != "" && !remote.MatchesPublicKey(pubKey) {
-			return errors.New("peer IDs don't match")
+			peerID, err := peer.IDFromPublicKey(pubKey)
+			if err != nil {
+				peerID = peer.ID(fmt.Sprintf("(not determined: %s)", err.Error()))
+			}
+			return fmt.Errorf("peer IDs don't match: expected %s, got %s", remote, peerID)
 		}
 		keyCh <- pubKey
 		return nil
diff --git a/transport_test.go b/transport_test.go
index 901c85e..2b5be8f 100644
--- a/transport_test.go
+++ b/transport_test.go
@@ -184,7 +184,8 @@ var _ = Describe("Transport", func() {
 		}()
 		// dial, but expect the wrong peer ID
 		_, err = clientTransport.SecureOutbound(context.Background(), clientInsecureConn, thirdPartyID)
-		Expect(err).To(MatchError("peer IDs don't match"))
+		Expect(err).To(HaveOccurred())
+		Expect(err.Error()).To(ContainSubstring("peer IDs don't match"))
 		Eventually(done).Should(BeClosed())
 	})