diff --git a/ctaocrypt/src/asn.c b/ctaocrypt/src/asn.c
index 4986fb02b..200b99b3d 100644
--- a/ctaocrypt/src/asn.c
+++ b/ctaocrypt/src/asn.c
@@ -2790,7 +2790,7 @@ int DerToPem(const byte* der, word32 derSz, byte* output, word32 outSz,
     i = headerLen;
 
     /* body */
-    outLen = outSz;  /* input to Base64_Encode */
+    outLen = outSz - (headerLen + footerLen);  /* input to Base64_Encode */
     if ( (err = Base64_Encode(der, derSz, output + i, (word32*)&outLen)) < 0)
         return err;
     i += outLen;