diff --git a/lib/ssl/authcert.c b/lib/ssl/authcert.c
--- a/lib/ssl/authcert.c
+++ b/lib/ssl/authcert.c
@@ -212,17 +212,17 @@ NSS_GetClientAuthData(void *arg,
                                                pw_arg);
         } else {
             int nnames = 0;
             char **names = ssl_DistNamesToStrings(caNames, &nnames);
             rv = CERT_FilterCertListByCANames(certList, nnames, names,
                                               certUsageSSLClient);
             ssl_FreeDistNamesStrings(names, nnames);
         }
-        if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) {
+        if ((rv != SECSuccess) || (certList && CERT_LIST_EMPTY(certList))) {
             CERT_DestroyCertList(certList);
             certList = NULL;
         }
     }
     if (certList == NULL) {
         /* no user certs meeting the nickname/usage requirements found */
         return SECFailure;
     }