diff --git a/CMakeLists.txt b/CMakeLists.txt
index 51237982f..f3d34331b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -327,7 +327,7 @@ set(PACKAGE "libwebsockets")
 set(CPACK_PACKAGE_NAME "${PACKAGE}")
 set(CPACK_PACKAGE_VERSION_MAJOR "4")
 set(CPACK_PACKAGE_VERSION_MINOR "0")
-set(CPACK_PACKAGE_VERSION_PATCH "19")
+set(CPACK_PACKAGE_VERSION_PATCH "20")
 set(CPACK_PACKAGE_RELEASE 1)
 set(CPACK_GENERATOR "RPM")
 set(CPACK_PACKAGE_VERSION "${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}")
diff --git a/lib/tls/mbedtls/mbedtls-x509.c b/lib/tls/mbedtls/mbedtls-x509.c
index f137a789c..54d47b1ed 100644
--- a/lib/tls/mbedtls/mbedtls-x509.c
+++ b/lib/tls/mbedtls/mbedtls-x509.c
@@ -240,7 +240,8 @@ lws_x509_parse_from_pem(struct lws_x509_cert *x509, const void *pem, size_t len)
 
 	ret = mbedtls_x509_crt_parse(&x509->cert, pem, len);
 	if (ret) {
-		mbedtls_x509_crt_free(&x509->cert);
+		if (ret > 0)
+			mbedtls_x509_crt_free(&x509->cert);
 		lwsl_err("%s: unable to parse PEM cert: -0x%x\n",
 			 __func__, -ret);