diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index cefdf179a..38b7af092 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -516,10 +516,10 @@ exit:
          * where pointers are to the raw certificate, but here all the
          * pointers were allocated while parsing from a user-provided string. */
         if (cur->node.type == MBEDTLS_X509_SAN_DIRECTORY_NAME) {
-            mbedtls_x509_name dn = cur->node.san.directory_name;
-            mbedtls_free(dn.oid.p);
-            mbedtls_free(dn.val.p);
-            mbedtls_asn1_free_named_data_list(&dn.next);
+            mbedtls_x509_name *dn = &cur->node.san.directory_name;
+            mbedtls_free(dn->oid.p);
+            mbedtls_free(dn->val.p);
+            mbedtls_asn1_free_named_data_list(&dn->next);
         }
         mbedtls_free(cur);
         cur = next;
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index 478dab71d..95f08b912 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -1012,10 +1012,10 @@ exit:
          * where pointers are to the raw certificate, but here all the
          * pointers were allocated while parsing from a user-provided string. */
         if (cur->node.type == MBEDTLS_X509_SAN_DIRECTORY_NAME) {
-            mbedtls_x509_name dn = cur->node.san.directory_name;
-            mbedtls_free(dn.oid.p);
-            mbedtls_free(dn.val.p);
-            mbedtls_asn1_free_named_data_list(&dn.next);
+            mbedtls_x509_name *dn = &cur->node.san.directory_name;
+            mbedtls_free(dn->oid.p);
+            mbedtls_free(dn->val.p);
+            mbedtls_asn1_free_named_data_list(&dn->next);
         }
         mbedtls_free(cur);
         cur = next;