diff --git a/lib/hx509/hxtool.c b/lib/hx509/hxtool.c
index 4f1297430..59793d25d 100644
--- a/lib/hx509/hxtool.c
+++ b/lib/hx509/hxtool.c
@@ -3196,6 +3196,8 @@ acert(struct acert_options *opt, int argc, char **argv)
         hx509_err(context, 1, ret, "Matching certificate did not meet "
                   "requirements");
     hx509_cert_free(cert);
+    hx509_query_free(context, q);
+    hx509_certs_free(&certs);
     free(sn);
     return 0;
 }