diff --git a/lib/hx509/ChangeLog b/lib/hx509/ChangeLog
index 7f73ebb42..f924cc249 100644
--- a/lib/hx509/ChangeLog
+++ b/lib/hx509/ChangeLog
@@ -1,5 +1,7 @@
 2007-12-09  Love Hörnquist Åstrand  <lha@it.su.se>
 
+	* handle refcount on NULL.
+
 	* test_nist_pkcs12.in: drop echo -n, doesn't work with posix sh
 
 2007-12-08  Love Hörnquist Åstrand  <lha@it.su.se>
diff --git a/lib/hx509/cert.c b/lib/hx509/cert.c
index fa7fdf34a..38b237d1a 100644
--- a/lib/hx509/cert.c
+++ b/lib/hx509/cert.c
@@ -383,6 +383,8 @@ hx509_cert_free(hx509_cert cert)
 hx509_cert
 hx509_cert_ref(hx509_cert cert)
 {
+    if (cert == NULL)
+	return NULL;
     if (cert->ref <= 0)
 	_hx509_abort("cert refcount <= 0");
     cert->ref++;
@@ -471,6 +473,8 @@ hx509_verify_attach_anchors(hx509_verify_ctx ctx, hx509_certs set)
 void
 hx509_verify_attach_revoke(hx509_verify_ctx ctx, hx509_revoke_ctx revoke_ctx)
 {
+    if (ctx->revoke_ctx)
+	hx509_revoke_free(&ctx->revoke_ctx);
     ctx->revoke_ctx = _hx509_revoke_ref(revoke_ctx);
 }
 
diff --git a/lib/hx509/keyset.c b/lib/hx509/keyset.c
index d383558f6..1494f0efe 100644
--- a/lib/hx509/keyset.c
+++ b/lib/hx509/keyset.c
@@ -146,6 +146,8 @@ hx509_certs_store(hx509_context context,
 hx509_certs
 _hx509_certs_ref(hx509_certs certs)
 {
+    if (certs == NULL)
+	return NULL;
     if (certs->ref <= 0)
 	_hx509_abort("certs refcount <= 0");
     certs->ref++;
diff --git a/lib/hx509/revoke.c b/lib/hx509/revoke.c
index 2ab981655..496ab8dff 100644
--- a/lib/hx509/revoke.c
+++ b/lib/hx509/revoke.c
@@ -82,6 +82,8 @@ hx509_revoke_init(hx509_context context, hx509_revoke_ctx *ctx)
 hx509_revoke_ctx
 _hx509_revoke_ref(hx509_revoke_ctx ctx)
 {
+    if (ctx == NULL)
+	return NULL;
     if (ctx->ref <= 0)
 	_hx509_abort("revoke ctx refcount <= 0");
     ctx->ref++;