diff --git a/src/openpgp/piv.c b/src/openpgp/piv.c
index 7becd17..6eae778 100644
--- a/src/openpgp/piv.c
+++ b/src/openpgp/piv.c
@@ -161,6 +161,7 @@ static int x509_create_cert(void *pk_ctx, uint8_t algo, uint8_t slot, bool attes
     if (attestation) {
         mbedtls_ecdsa_free(&actx);
     }
+    mbedtls_x509write_crt_free(&ctx);
     return ret;
 }