diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index bfc0965..53ac526 100644
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -690,6 +690,20 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
 				return 0;
 			}
 
+			if (ENGINE_init(engine_ptr) == 0)
+			{
+				char	   *err = SSLerrmessage();
+
+				printfPQExpBuffer(&conn->errorMessage,
+					 libpq_gettext("could not initialize SSL engine \"%s\": %s\n"),
+								  engine_str, err);
+				SSLerrfree(err);
+				ENGINE_free(engine_ptr);
+				free(engine_str);
+				ERR_pop_to_mark();
+				return 0;
+			}
+
 			*pkey = ENGINE_load_private_key(engine_ptr, engine_colon,
 											NULL, NULL);
 			if (*pkey == NULL)
@@ -700,10 +714,14 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
 								  libpq_gettext("could not read private SSL key \"%s\" from engine \"%s\": %s\n"),
 								  engine_colon, engine_str, err);
 				SSLerrfree(err);
+				ENGINE_finish(engine_ptr);
+				ENGINE_free(engine_ptr);
 				free(engine_str);
 				ERR_pop_to_mark();
 				return 0;
 			}
+			ENGINE_finish(engine_ptr);
+			ENGINE_free(engine_ptr);
 			free(engine_str);
 
 			fnbuf[0] = '\0';	/* indicate we're not going to load from a