diff --git a/apps/ca.c b/apps/ca.c
index 85766cccbbd97d3d1da3e8ff75e11a7e4b712ef8..cc74c5bd25581e94c82cda115fd22848ed4931d2 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -2071,6 +2071,7 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
 
     j = NETSCAPE_SPKI_verify(spki, pktmp);
     if (j <= 0) {
+        EVP_PKEY_free(pktmp);
         BIO_printf(bio_err,
                    "signature verification failed on SPKAC public key\n");
         goto end;