diff --git a/src/tcp.c b/src/tcp.c
index 47e62a1..9f28f90 100644
--- a/src/tcp.c
+++ b/src/tcp.c
@@ -1458,7 +1458,7 @@ relpTcpInitTLS(relpTcp_t *const pThis)
 static relpRetVal
 relpTcpChkPeerAuth(relpTcp_t *const pThis)
 {
-	X509* certpeer;
+	X509 *certpeer = NULL;
 	int r;
 	ENTER_RELPFUNC;
 
@@ -1502,6 +1502,8 @@ relpTcpChkPeerAuth(relpTcp_t *const pThis)
 	}
 
 finalize_it:
+	if(certpeer != NULL)
+		X509_free(certpeer);
 	LEAVE_RELPFUNC;
 }
 
diff --git a/tests/tls-basic-vg.sh b/tests/tls-basic-vg.sh
index 6ee1fac..e58a1eb 100755
--- a/tests/tls-basic-vg.sh
+++ b/tests/tls-basic-vg.sh
@@ -5,6 +5,7 @@ if [ "$VALGRIND" == "NO" ] ; then
    echo "valgrind tests are not permitted by environment config"
    exit 77
 fi
+export valgrind="$valgrind --leak-check=full --show-leak-kinds=definite --errors-for-leak-kinds=definite --error-exitcode=10"
 if [ $(uname) = "SunOS" ] ; then
    echo "This test currently does not work on all flavors of Solaris."
    exit 77