diff --git a/lib/hx509/hxtool.c b/lib/hx509/hxtool.c
index d4711174e..aa2bed647 100644
--- a/lib/hx509/hxtool.c
+++ b/lib/hx509/hxtool.c
@@ -1596,6 +1596,8 @@ hxtool_ca(struct certificate_sign_options *opt, int argc, char **argv)
 
     if (subject)
 	hx509_name_free(&subject);
+    if (signer)
+	hx509_cert_free(signer);
     hx509_cert_free(cert);
     free_SubjectPublicKeyInfo(&spki);