diff --git a/ChangeLog b/ChangeLog
index 375e4d879..506faa40d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,10 @@
      [sshconnect2.c]
      fix bzero(ptr_to_struct, sizeof(ptr_to_struct)); bz#2100 from
      Colin Watson
+   - djm@cvs.openbsd.org 2013/05/10 04:08:01
+     [key.c]
+     memleak in cert_free(), wasn't actually freeing the struct;
+     bz#2096 from shm AT digitalsun.pl
 
 20130510
  - (dtucker) [configure.ac] Enable -Wsizeof-pointer-memaccess if the compiler
diff --git a/key.c b/key.c
index 471cd1fcc..b8c60cb2c 100644
--- a/key.c
+++ b/key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.101 2013/04/19 01:06:50 djm Exp $ */
+/* $OpenBSD: key.c,v 1.102 2013/05/10 04:08:01 djm Exp $ */
 /*
  * read_bignum():
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -195,6 +195,7 @@ cert_free(struct KeyCert *cert)
 		xfree(cert->principals);
 	if (cert->signature_key != NULL)
 		key_free(cert->signature_key);
+	xfree(cert);
 }
 
 void