diff --git a/src/acme.c b/src/acme.c
index bae7230bb..def664aa7 100644
--- a/src/acme.c
+++ b/src/acme.c
@@ -2153,6 +2153,7 @@ int acme_res_neworder(struct task *task, struct acme_ctx *ctx, char **errmsg)
 
 		auth->auth = istdup(ist2(trash.area, trash.data));
 		if (!isttest(auth->auth)) {
+			free(auth);
 			memprintf(errmsg, "out of memory");
 			goto error;
 		}
@@ -2162,6 +2163,11 @@ int acme_res_neworder(struct task *task, struct acme_ctx *ctx, char **errmsg)
 		ctx->next_auth = auth;
 	}
 
+	if (!ctx->auths) {
+		memprintf(errmsg, "no authorizations found in newOrder response");
+		goto error;
+	}
+
 	if ((ret = mjson_get_string(hc->res.buf.area, hc->res.buf.data, "$.finalize", trash.area, trash.size)) <= 0) {
 		memprintf(errmsg, "couldn't find the finalize URL");
 		goto error;