diff --git a/lib/hx509/keyset.c b/lib/hx509/keyset.c
index 86274cbda..a8c68596b 100644
--- a/lib/hx509/keyset.c
+++ b/lib/hx509/keyset.c
@@ -112,6 +112,7 @@ hx509_certs_init(hx509_context context,
 	return ENOMEM;
     }
     c->ops = ops;
+    c->ref = 1;
 
     ret = (*ops->init)(context, c, &c->ops_data, flags, residue, lock);
     if (ret) {