diff --git a/src/shrpx_mruby_module_env.cc b/src/shrpx_mruby_module_env.cc
index ba220e1a..06a5195b 100644
--- a/src/shrpx_mruby_module_env.cc
+++ b/src/shrpx_mruby_module_env.cc
@@ -161,6 +161,7 @@ mrb_value env_get_tls_client_fingerprint(mrb_state *mrb, mrb_value self) {
   // Fingerprint is SHA-256, so we need 32 bytes buffer.
   std::array<uint8_t, 32> buf;
   auto slen = tls::get_x509_fingerprint(buf.data(), buf.size(), x);
+  X509_free(x);
   if (slen == -1) {
     mrb_raise(mrb, E_RUNTIME_ERROR, "could not compute client fingerprint");
   }
@@ -192,6 +193,7 @@ mrb_value env_get_tls_client_subject_name(mrb_state *mrb, mrb_value self) {
 
   auto &balloc = downstream->get_block_allocator();
   auto name = tls::get_x509_subject_name(balloc, x);
+  X509_free(x);
   return mrb_str_new(mrb, name.c_str(), name.size());
 }
 } // namespace