diff --git a/kdc/kx509.c b/kdc/kx509.c
index fb393bd59..25861fbca 100644
--- a/kdc/kx509.c
+++ b/kdc/kx509.c
@@ -161,8 +161,6 @@ build_certificate(krb5_context context,
     if (ret)
 	goto out;
 
-    krb5_xfree(name);
-
     {
 	hx509_certs certs;
 	hx509_query *q;
@@ -264,6 +262,9 @@ build_certificate(krb5_context context,
     if (ret)
 	goto out;
 
+    /* cleanup on success */
+    krb5_xfree(name);
+
     return 0;
 out:
     if (name)