diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 0740c32fbb..802f3da862 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -4669,6 +4669,7 @@ out:
 struct ossl_certs_ctx {
   STACK_OF(X509) *sk;
   size_t num_certs;
+  unsigned char *last_der;
 };
 
 static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf,
@@ -4682,6 +4683,9 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf,
   X509 *cert;
   int der_len;
 
+  OPENSSL_free(chain->last_der);
+  chain->last_der = NULL;
+
   (void)cf;
   (void)data;
   *pder_len = 0;
@@ -4695,6 +4699,7 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf,
   der_len = i2d_X509(cert, pder);
   if(der_len < 0)
     return CURLE_FAILED_INIT;
+  chain->last_der = *pder;
   *pder_len = (size_t)der_len;
   return CURLE_OK;
 }
@@ -4748,6 +4753,8 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
     result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
                                     ossl_chain_get_der, &chain,
                                     ocsp_data, ocsp_len);
+    OPENSSL_free(chain.last_der);
+    chain.last_der = NULL;
     if(!result && ocsp_missing && conn_config->verifystatus &&
        !octx->reused_session) {
       /* verified, but OCSP stapling is required and server sent none */