diff --git a/src/crypto/x509/x509.go b/src/crypto/x509/x509.go
index f7ee1b511c2..2283f6cac3a 100644
--- a/src/crypto/x509/x509.go
+++ b/src/crypto/x509/x509.go
@@ -1694,7 +1694,7 @@ func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv
 		}
 	}
 
-	// RFC 5280 Section 4.1.2.2: serial number must positive
+	// RFC 5280 Section 4.1.2.2: serial number must be positive
 	//
 	// We _should_ also restrict serials to <= 20 octets, but it turns out a lot of people
 	// get this wrong, in part because the encoding can itself alter the length of the