diff --git a/src/crypto/pkcs12.c b/src/crypto/pkcs12.c
index 3ab8a38..79b3d6e 100644
--- a/src/crypto/pkcs12.c
+++ b/src/crypto/pkcs12.c
@@ -280,6 +280,7 @@
                         NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
                         NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
                         iter, maciter, 0);
+    sk_X509_free(cacerts); /* don't free the certs, just the stack */
     if( p12 == NULL ) {
         exception_from_error_queue(crypto_Error);
         return NULL;