diff --git a/lib/hx509/print.c b/lib/hx509/print.c
index da817a7b3..e53732097 100644
--- a/lib/hx509/print.c
+++ b/lib/hx509/print.c
@@ -603,9 +603,6 @@ hx509_validate_cert(hx509_context context,
     if (hx509_name_cmp(subject, issuer) == 0)
 	status.selfsigned = 1;
 
-    hx509_name_free(&subject);
-    hx509_name_free(&issuer);
-
     validate_print(ctx, HX509_VALIDATE_F_VERBOSE,
 		   "Validity:\n");
 
@@ -687,5 +684,12 @@ hx509_validate_cert(hx509_context context,
 			   "Proxy and have IAN\n");
     }
 
+    if (hx509_name_is_null_p(subject) && status.haveSAN)
+	validate_print(ctx, HX509_VALIDATE_F_VALIDATE, 
+		       "NULL subject DN and doesn't have a SAN\n");
+
+    hx509_name_free(&subject);
+    hx509_name_free(&issuer);
+
     return 0;
 }