diff --git a/pkg/tinydtls/contrib/sock_dtls.c b/pkg/tinydtls/contrib/sock_dtls.c
index 2fe877eace..7c537370c7 100644
--- a/pkg/tinydtls/contrib/sock_dtls.c
+++ b/pkg/tinydtls/contrib/sock_dtls.c
@@ -421,8 +421,14 @@ int sock_dtls_create(sock_dtls_t *sock, sock_udp_t *udp_sock,
 #endif /* SOCK_HAS_ASYNC */
 
     memset(sock->tags, CREDMAN_TAG_EMPTY, CONFIG_DTLS_CREDENTIALS_MAX * sizeof(credman_tag_t));
-    sock->tags_len = 1;
-    sock->tags[0] = tag;
+
+    if (tag != CREDMAN_TAG_EMPTY) {
+        sock->tags_len = 1;
+        sock->tags[0] = tag;
+    }
+    else {
+        sock->tags_len = 0;
+    }
 
     sock->role = role;
     sock->dtls_ctx = dtls_new_context(sock);
diff --git a/sys/include/net/sock/dtls.h b/sys/include/net/sock/dtls.h
index 198fd36a38..55a1377229 100644
--- a/sys/include/net/sock/dtls.h
+++ b/sys/include/net/sock/dtls.h
@@ -652,7 +652,9 @@ void sock_dtls_init(void);
  * @param[in] udp_sock  Existing UDP sock initialized with
  *                      @ref sock_udp_create() to be used underneath.
  * @param[in] tag       Credential tag of @p sock. The sock will only use
- *                      credentials with the same tag given here.
+ *                      credentials with the tags registered to it
+ *                      (see @ref sock_dtls_add_credential). Set to @ref CREDMAN_TAG_EMPTY to
+ *                      create a sock with an empty tag list.
  * @param[in] version   [DTLS version](@ref sock_dtls_prot_version) to use.
  * @param[in] role      [Role](@ref sock_dtls_role) of the endpoint.
  *