diff --git a/kdc/hpropd.c b/kdc/hpropd.c
index a931d7f68..fcd200dcf 100644
--- a/kdc/hpropd.c
+++ b/kdc/hpropd.c
@@ -176,7 +176,7 @@ main(int argc, char **argv)
 	ret = krb5_unparse_name(context, ticket->server, &server);
 	if (ret)
 	    krb5_err(context, 1, ret, "krb5_unparse_name");
-	if (strncmp(server, "hprop/", 5) != 0)
+	if (strncmp(server, "hprop/", 6) != 0)
 	    krb5_errx(context, 1, "ticket not for hprop (%s)", server);
 
 	free(server);
diff --git a/lib/hx509/hxtool.c b/lib/hx509/hxtool.c
index 0a7048bdf..e686a6080 100644
--- a/lib/hx509/hxtool.c
+++ b/lib/hx509/hxtool.c
@@ -944,7 +944,7 @@ pcert_verify(struct verify_options *opt, int argc, char **argv)
 	    if (ret)
 		errx(1, "hx509_revoke_add_crl: %s: %d", s, ret);
 
-	} else if (strncmp(s, "ocsp:", 4) == 0) {
+	} else if (strncmp(s, "ocsp:", 5) == 0) {
 	    s += 5;
 
 	    ret = hx509_revoke_add_ocsp(context, revoke_ctx, s);
@@ -1155,7 +1155,7 @@ revoke_print(struct revoke_print_options *opt, int argc, char **argv)
 	    if (ret)
 		errx(1, "hx509_revoke_add_crl: %s: %d", s, ret);
 
-	} else if (strncmp(s, "ocsp:", 4) == 0) {
+	} else if (strncmp(s, "ocsp:", 5) == 0) {
 	    s += 5;
 
 	    ret = hx509_revoke_add_ocsp(context, revoke_ctx, s);