diff --git a/src/internal.c b/src/internal.c
index c597f9154..875dddf63 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -8555,10 +8555,6 @@ int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
     x509->pkCurveOID = dCert->pkCurveOID;
 #endif /* HAVE_ECC */
 
-    if (ret != 0) {
-        wolfSSL_X509_free(x509);
-    }
-
     return ret;
 }
 
@@ -8862,6 +8858,9 @@ static int DoVerifyCallback(WOLFSSL* ssl, int ret, ProcPeerCertArgs* args)
             if (CopyDecodedToX509(x509, args->dCert) == 0) {
                 store->current_cert = x509;
             }
+            else {
+                FreeX509(x509);
+            }
         }
     #endif
     #ifdef SESSION_CERTS