diff --git a/src/ngx_http_voms_module.cpp b/src/ngx_http_voms_module.cpp
index d0ee2767fd08e68d12cf496cbda1bf573172dd6d..29ae6a9855c42b5dedd966fb96c806ce8cbe6638 100644
--- a/src/ngx_http_voms_module.cpp
+++ b/src/ngx_http_voms_module.cpp
@@ -544,7 +544,7 @@ static X509* get_ee_cert(ngx_http_request_t* r)
     // find first non-proxy and non-ca cert
     for (int i = 0; i != sk_X509_num(chain); ++i) {
       auto cert = sk_X509_value(chain, i);
-      if (is_ca(cert)) {
+      if (cert && is_ca(cert)) {
         break;
       }
       if (cert && !is_proxy(cert)) {