diff --git a/crypto/x509/x509_lcl.h b/crypto/x509/x509_lcl.h
index 71c8a2af6bc22fd93b183781ea42691891bc6133..af043417c34cf6d45af34688424e80622a52a713 100644
--- a/crypto/x509/x509_lcl.h
+++ b/crypto/x509/x509_lcl.h
@@ -98,7 +98,7 @@ struct x509_attributes_st {
 struct X509_extension_st {
     ASN1_OBJECT *object;
     ASN1_BOOLEAN critical;
-    ASN1_OCTET_STRING *value;
+    ASN1_OCTET_STRING value;
 };
 
 /*
diff --git a/crypto/x509/x509_v3.c b/crypto/x509/x509_v3.c
index 4e9c8f540780d2b3a8ce32750c4cb01dd00a4acc..f192979842d2cf08971fd68a1243f77ba7bd5e4d 100644
--- a/crypto/x509/x509_v3.c
+++ b/crypto/x509/x509_v3.c
@@ -253,7 +253,7 @@ int X509_EXTENSION_set_data(X509_EXTENSION *ex, ASN1_OCTET_STRING *data)
 
     if (ex == NULL)
         return (0);
-    i = ASN1_OCTET_STRING_set(ex->value, data->data, data->length);
+    i = ASN1_OCTET_STRING_set(&ex->value, data->data, data->length);
     if (!i)
         return (0);
     return (1);
@@ -270,7 +270,7 @@ ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ex)
 {
     if (ex == NULL)
         return (NULL);
-    return (ex->value);
+    return &ex->value;
 }
 
 int X509_EXTENSION_get_critical(X509_EXTENSION *ex)
diff --git a/crypto/x509/x_exten.c b/crypto/x509/x_exten.c
index c0d4c96287ddc6f148eedec0b048f4902ebaa8c0..c5b391f948b86f7f67df73d5eb5e0145652ad9f6 100644
--- a/crypto/x509/x_exten.c
+++ b/crypto/x509/x_exten.c
@@ -66,7 +66,7 @@
 ASN1_SEQUENCE(X509_EXTENSION) = {
         ASN1_SIMPLE(X509_EXTENSION, object, ASN1_OBJECT),
         ASN1_OPT(X509_EXTENSION, critical, ASN1_BOOLEAN),
-        ASN1_SIMPLE(X509_EXTENSION, value, ASN1_OCTET_STRING)
+        ASN1_EMBED(X509_EXTENSION, value, ASN1_OCTET_STRING)
 } ASN1_SEQUENCE_END(X509_EXTENSION)
 
 ASN1_ITEM_TEMPLATE(X509_EXTENSIONS) =