diff --git a/ssh/key.c b/ssh/key.c
index be3c486..fc9a7b8 100644
--- a/ssh/key.c
+++ b/ssh/key.c
@@ -395,6 +395,7 @@ cert_free(struct sshkey_cert *cert)
 	if (cert->signature_key != NULL)
 		sshkey_free(cert->signature_key);
 	bzero(cert, sizeof(*cert));
+	free(cert);
 }
 
 void