diff --git a/src/management/nfd-controller.cpp b/src/management/nfd-controller.cpp
index acd2435..0a56777 100644
--- a/src/management/nfd-controller.cpp
+++ b/src/management/nfd-controller.cpp
@@ -30,14 +30,15 @@
 
 const uint32_t Controller::ERROR_TIMEOUT = 10060; // WinSock ESAETIMEDOUT
 const uint32_t Controller::ERROR_NACK = 10800; // 10000 + TLV-TYPE of Nack header
+const uint32_t Controller::ERROR_VALIDATION = 10021; // 10000 + TLS1_ALERT_DECRYPTION_FAILED
 const uint32_t Controller::ERROR_SERVER = 500;
 const uint32_t Controller::ERROR_LBOUND = 400;
 ValidatorNull Controller::s_validatorNull;
 
-Controller::Controller(Face& face, KeyChain& keyChain)
+Controller::Controller(Face& face, KeyChain& keyChain, Validator& validator)
   : m_face(face)
   , m_keyChain(keyChain)
-  , m_validator(s_validatorNull) /// \todo #3653 accept validator as constructor parameter
+  , m_validator(validator)
 {
 }
 
@@ -136,7 +137,9 @@
       onFailure(ERROR_SERVER, msg);
       break;
     case SegmentFetcher::ErrorCode::SEGMENT_VALIDATION_FAIL:
-      BOOST_ASSERT(false); /// \todo #3653 introduce ERROR_VALIDATION
+      /// \todo When SegmentFetcher exposes validator error code, Controller::ERROR_VALIDATION
+      ///       should be replaced with a range that corresponds to validator error codes.
+      onFailure(ERROR_VALIDATION, msg);
       break;
     case SegmentFetcher::ErrorCode::NACK_ERROR:
       onFailure(ERROR_NACK, msg);
diff --git a/src/management/nfd-controller.hpp b/src/management/nfd-controller.hpp
index 7ebc5eb..3ae1cf2 100644
--- a/src/management/nfd-controller.hpp
+++ b/src/management/nfd-controller.hpp
@@ -55,7 +55,7 @@
   /** \brief construct a Controller that uses face for transport,
    *         and uses the passed KeyChain to sign commands
    */
-  Controller(Face& face, KeyChain& keyChain);
+  Controller(Face& face, KeyChain& keyChain, Validator& validator = s_validatorNull);
 
   /** \brief start command execution
    */
@@ -140,6 +140,10 @@
    */
   static const uint32_t ERROR_NACK;
 
+  /** \brief error code for response validation failure
+   */
+  static const uint32_t ERROR_VALIDATION;
+
   /** \brief error code for server error
    */
   static const uint32_t ERROR_SERVER;