diff --git a/NEWS b/NEWS
index 52d9b956afa..61114e8226a 100644
--- a/NEWS
+++ b/NEWS
@@ -33,6 +33,10 @@ PHP                                                                        NEWS
   . Added workaround for SELinux mprotect execheap issue.
     See https://bugzilla.kernel.org/show_bug.cgi?id=218258. (ilutov)
 
+- OpenSSL:
+  . Fixed bug GH-12987 (openssl_csr_sign might leak new cert on error).
+    (Jakub Zelenka)
+
 - PDO_ODBC:
   . Fixed bug GH-12767 (Unable to turn on autocommit mode with setAttribute()).
     (SakiTakamachi)
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index b16e2154963..9698b54a210 100644
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -3194,6 +3194,7 @@ PHP_FUNCTION(openssl_csr_sign)
 	X509 *cert = NULL, *new_cert = NULL;
 	EVP_PKEY * key = NULL, *priv_key = NULL;
 	int i;
+	bool new_cert_used = false;
 	struct php_x509_request req;
 
 	ZEND_PARSE_PARAMETERS_START(4, 6)
@@ -3315,11 +3316,12 @@ PHP_FUNCTION(openssl_csr_sign)
 	object_init_ex(return_value, php_openssl_certificate_ce);
 	cert_object = Z_OPENSSL_CERTIFICATE_P(return_value);
 	cert_object->x509 = new_cert;
+	new_cert_used = true;
 
 cleanup:
 
-	if (cert == new_cert) {
-		cert = NULL;
+	if (!new_cert_used && new_cert) {
+		X509_free(new_cert);
 	}
 
 	PHP_SSL_REQ_DISPOSE(&req);
@@ -3328,7 +3330,7 @@ cleanup:
 	if (csr_str) {
 		X509_REQ_free(csr);
 	}
-	if (cert_str && cert) {
+	if (cert_str && cert && cert != new_cert) {
 		X509_free(cert);
 	}
 }