diff --git a/CHANGELOG.md b/CHANGELOG.md
index 79c49a4fee..320563c2f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ librdkafka v1.9.3 is a maintenance release:
 ### General fixes
 
  * Windows: couldn't read a PKCS#12 keystore correctly because binary mode wasn't explicitly set and Windows defaults to text mode.
+ * Fixed memory leak when loading SSL certificates (@Mekk, #3930)
 
 ## Enhancements
 
diff --git a/src/rdkafka_cert.c b/src/rdkafka_cert.c
index dc51708738..ebfd164c42 100644
--- a/src/rdkafka_cert.c
+++ b/src/rdkafka_cert.c
@@ -273,6 +273,7 @@ static rd_kafka_cert_t *rd_kafka_cert_new(const rd_kafka_conf_t *conf,
                                         goto fail;
                                 }
 
+                                X509_free(x509);
                                 cnt++;
                         }