diff --git a/lib/hx509/cms.c b/lib/hx509/cms.c
index ee97d0553..b8bb59192 100644
--- a/lib/hx509/cms.c
+++ b/lib/hx509/cms.c
@@ -1193,6 +1193,8 @@ hx509_cms_create_signed_1(hx509_context context,
 		hx509_clear_error_string(context);
 		goto out;
 	    }
+	    if (sd.certificates->val[i].length != size)
+		_hx509_abort("internal ASN.1 encoder error");
 	}
     }