diff --git a/ctx.go b/ctx.go
index a9d1da0..af0519e 100644
--- a/ctx.go
+++ b/ctx.go
@@ -300,6 +300,8 @@ func (c *Ctx) AddChainCertificate(cert *Certificate) error {
 	if int(C.SSL_CTX_add_extra_chain_cert_not_a_macro(c.ctx, cert.x)) != 1 {
 		return errorFromErrorQueue()
 	}
+	// OpenSSL takes ownership via SSL_CTX_add_extra_chain_cert
+	runtime.SetFinalizer(cert, nil)
 	return nil
 }