avoid calling hx509_free_cert() twice