diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
index 51998cab9c..7af370c3b0 100644
--- a/programs/pluto/nss_cert_verify.c
+++ b/programs/pluto/nss_cert_verify.c
@@ -408,6 +408,7 @@ static void add_decoded_cert(CERTCertDBHandle *handle,
 		if (pk == NULL) {
 			llog_nss_error(RC_LOG, logger,
 				       "extracting certificate public key using CERT_ExtractPublicKey() failed");
+			CERT_DestroyCertificate(cert);
  			return;
  		}