diff --git a/kdc/kx509.c b/kdc/kx509.c
index 36a6480d3..b12d0b81b 100644
--- a/kdc/kx509.c
+++ b/kdc/kx509.c
@@ -203,9 +203,10 @@ build_certificate(krb5_context context,
 
     {
 	SubjectPublicKeyInfo spki;
-	memset(&spki, 0, sizeof(spki));
 	heim_any any;
 
+	memset(&spki, 0, sizeof(spki));
+
 	spki.subjectPublicKey.data = key->data;
 	spki.subjectPublicKey.length = key->length * 8;