diff --git a/ChangeLog b/ChangeLog
index 12f275eef..250599b57 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -30,6 +30,9 @@
    - jmc@cvs.openbsd.org 2013/12/06 15:29:07
      [sshd.8]
      missing comma;
+   - djm@cvs.openbsd.org 2013/12/07 00:19:15
+     [key.c]
+     set k->cert = NULL after freeing it
  - [blocks.c ed25519.c fe25519.c fe25519.h ge25519.c ge25519.h]
    [ge25519_base.data hash.c sc25519.c sc25519.h verify.c] Fix RCS idents
 
diff --git a/key.c b/key.c
index 236e02676..814f9a001 100644
--- a/key.c
+++ b/key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.108 2013/12/06 13:34:54 markus Exp $ */
+/* $OpenBSD: key.c,v 1.110 2013/12/07 00:19:15 djm Exp $ */
 /*
  * read_bignum():
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1955,6 +1955,7 @@ key_drop_cert(Key *k)
 		return -1;
 	}
 	cert_free(k->cert);
+	k->cert = NULL;
 	k->type = key_type_plain(k->type);
 	return 0;
 }