diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c
index 5086feda4..3cedab7ee 100644
--- a/src/libstrongswan/plugins/openssl/openssl_x509.c
+++ b/src/libstrongswan/plugins/openssl/openssl_x509.c
@@ -982,7 +982,7 @@ static bool parse_ipAddrBlock_ext(private_openssl_x509_t *this,
 
 	if (!X509v3_addr_is_canonical(blocks))
 	{
-		sk_IPAddressFamily_free(blocks);
+		sk_IPAddressFamily_pop_free(blocks, IPAddressFamily_free);
 		return FALSE;
 	}