diff --git a/lib/hx509/cert.c b/lib/hx509/cert.c
index 2d6f58612..39790266f 100644
--- a/lib/hx509/cert.c
+++ b/lib/hx509/cert.c
@@ -844,7 +844,8 @@ check_key_usage(hx509_context context, const Certificate *cert,
 	_hx509_unparse_Name(&cert->tbsCertificate.subject, &name);
 	hx509_set_error_string(context, 0, HX509_KU_CERT_MISSING,
 			       "Key usage %s required but missing "
-			       "from certifiate %s", buf, name);
+			       "from certifiate %s", buf,
+                               name ? name : "<unknown>");
 	free(name);
 	return HX509_KU_CERT_MISSING;
     }
diff --git a/lib/hx509/name.c b/lib/hx509/name.c
index fb6be5cd4..ee192e593 100644
--- a/lib/hx509/name.c
+++ b/lib/hx509/name.c
@@ -240,6 +240,8 @@ _hx509_Name_to_string(const Name *n, char **str)
 		ret = wind_ucs2utf8_length(bmp, bmplen, &k);
 		if (ret) {
                     free(oidname);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
                 }
 
@@ -250,6 +252,8 @@ _hx509_Name_to_string(const Name *n, char **str)
 		if (ret) {
                     free(oidname);
 		    free(ss);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
 		}
 		ss[k] = '\0';
@@ -268,6 +272,8 @@ _hx509_Name_to_string(const Name *n, char **str)
 		ret = wind_ucs4utf8_length(uni, unilen, &k);
 		if (ret) {
                     free(oidname);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
                 }
 
@@ -278,6 +284,8 @@ _hx509_Name_to_string(const Name *n, char **str)
 		if (ret) {
 		    free(ss);
                     free(oidname);
+                    free(*str);
+                    *str = NULL;
 		    return ret;
 		}
 		ss[k] = '\0';