diff --git a/src/ocsp.c b/src/ocsp.c
index 78b1f0e84..eca389493 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -859,8 +859,8 @@ int wolfSSL_OCSP_basic_verify(WOLFSSL_OCSP_BASICRESP *bs,
             WOLFSSL_X509* x = wolfSSL_sk_X509_value(certs, idx);
             int derSz = 0;
             const byte* der = wolfSSL_X509_get_der(x, &derSz);
-
-            if (derSz == (int)bs->certSz && XMEMCMP(bs->cert, der, derSz) == 0) {
+            if (der != NULL && derSz == (int)bs->certSz &&
+                    XMEMCMP(bs->cert, der, derSz) == 0) {
                 ret = WOLFSSL_SUCCESS;
                 goto out;
             }
diff --git a/src/ssl.c b/src/ssl.c
index ae8ca740d..9ba44df3f 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -8715,9 +8715,10 @@ int wolfSSL_SetCRL_Cb(WOLFSSL* ssl, CbMissingCRL cb)
 int wolfSSL_SetCRL_IOCb(WOLFSSL* ssl, CbCrlIO cb)
 {
     WOLFSSL_ENTER("wolfSSL_SetCRL_Cb");
-    SSL_CM_WARNING(ssl);
-    if (ssl)
+    if (ssl) {
+        SSL_CM_WARNING(ssl);
         return wolfSSL_CertManagerSetCRL_IOCb(SSL_CM(ssl), cb);
+    }
     else
         return BAD_FUNC_ARG;
 }