diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index a4a647eee..a6a4ce4b9 100644
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -2190,6 +2190,7 @@ static int openssl_cert_tod(X509 *cert)
 		else if (os_strcmp(buf, "1.3.6.1.4.1.40808.1.3.2") == 0 && !tod)
 			tod = 2; /* TOD-TOFU */
 	}
+	sk_POLICYINFO_pop_free(ext, POLICYINFO_free);
 
 	return tod;
 }