diff --git a/dll/win32/winhttp/net.c b/dll/win32/winhttp/net.c
index e9ff86a165..4e417e5df3 100644
--- a/dll/win32/winhttp/net.c
+++ b/dll/win32/winhttp/net.c
@@ -47,7 +47,6 @@
 #include "windef.h"
 #include "winbase.h"
 #include "winhttp.h"
-#include "wincrypt.h"
 #include "schannel.h"
 
 #include "winhttp_private.h"
diff --git a/dll/win32/winhttp/request.c b/dll/win32/winhttp/request.c
index 5bb5b09337..8336b6c799 100644
--- a/dll/win32/winhttp/request.c
+++ b/dll/win32/winhttp/request.c
@@ -1769,6 +1769,10 @@ static BOOL open_connection( request_t *request )
                     return FALSE;
                 }
             }
+
+            CertFreeCertificateContext( request->server_cert );
+            request->server_cert = NULL;
+
             if (!ensure_cred_handle( connect->session ) ||
                 !netconn_secure_connect( netconn, connect->hostname, request->security_flags,
                                          &connect->session->cred_handle ))
@@ -1791,6 +1795,13 @@ static BOOL open_connection( request_t *request )
         request->netconn = netconn;
     }
 
+    if (netconn->secure && !(request->server_cert = netconn_get_certificate( netconn )))
+    {
+        heap_free( addressW );
+        netconn_close( netconn );
+        return FALSE;
+    }
+
 done:
     request->read_pos = request->read_size = 0;
     request->read_chunked = FALSE;
diff --git a/dll/win32/winhttp/session.c b/dll/win32/winhttp/session.c
index 7cfc240758..158ff0487f 100644
--- a/dll/win32/winhttp/session.c
+++ b/dll/win32/winhttp/session.c
@@ -40,7 +40,6 @@
 #include "winsock2.h"
 #include "ws2ipdef.h"
 #include "winhttp.h"
-#include "wincrypt.h"
 #include "winreg.h"
 #define COBJMACROS
 #include "ole2.h"
@@ -603,6 +602,8 @@ static void request_destroy( object_header_t *hdr )
     }
     release_object( &request->connect->hdr );
 
+    CertFreeCertificateContext( request->server_cert );
+
     destroy_authinfo( request->authinfo );
     destroy_authinfo( request->proxy_authinfo );
 
@@ -763,14 +764,14 @@ static BOOL request_query_option( object_header_t *hdr, DWORD option, LPVOID buf
             return FALSE;
         }
 
-        if (!request->netconn || !(cert = netconn_get_certificate( request->netconn ))) return FALSE;
+        if (!(cert = CertDuplicateCertificateContext( request->server_cert ))) return FALSE;
         *(CERT_CONTEXT **)buffer = (CERT_CONTEXT *)cert;
         *buflen = sizeof(cert);
         return TRUE;
     }
     case WINHTTP_OPTION_SECURITY_CERTIFICATE_STRUCT:
     {
-        const CERT_CONTEXT *cert;
+        const CERT_CONTEXT *cert = request->server_cert;
         const CRYPT_OID_INFO *oidInfo;
         WINHTTP_CERTIFICATE_INFO *ci = buffer;
 
@@ -782,16 +783,14 @@ static BOOL request_query_option( object_header_t *hdr, DWORD option, LPVOID buf
             set_last_error( ERROR_INSUFFICIENT_BUFFER );
             return FALSE;
         }
-        if (!request->netconn || !(cert = netconn_get_certificate( request->netconn ))) return FALSE;
+        if (!cert) return FALSE;
 
         ci->ftExpiry = cert->pCertInfo->NotAfter;
         ci->ftStart  = cert->pCertInfo->NotBefore;
         ci->lpszSubjectInfo = blob_to_str( cert->dwCertEncodingType, &cert->pCertInfo->Subject );
         ci->lpszIssuerInfo  = blob_to_str( cert->dwCertEncodingType, &cert->pCertInfo->Issuer );
         ci->lpszProtocolName      = NULL;
-        oidInfo = CryptFindOIDInfo( CRYPT_OID_INFO_OID_KEY,
-                                    cert->pCertInfo->SignatureAlgorithm.pszObjId,
-                                    0 );
+        oidInfo = CryptFindOIDInfo( CRYPT_OID_INFO_OID_KEY, cert->pCertInfo->SignatureAlgorithm.pszObjId, 0 );
         if (oidInfo)
             ci->lpszSignatureAlgName = (LPWSTR)oidInfo->pwszName;
         else
@@ -799,7 +798,6 @@ static BOOL request_query_option( object_header_t *hdr, DWORD option, LPVOID buf
         ci->lpszEncryptionAlgName = NULL;
         ci->dwKeySize = request->netconn ? netconn_get_cipher_strength( request->netconn ) : 0;
 
-        CertFreeCertificateContext( cert );
         *buflen = sizeof(*ci);
         return TRUE;
     }
diff --git a/dll/win32/winhttp/winhttp_private.h b/dll/win32/winhttp/winhttp_private.h
index d5ec9ca4f9..a57eb2ae37 100644
--- a/dll/win32/winhttp/winhttp_private.h
+++ b/dll/win32/winhttp/winhttp_private.h
@@ -46,6 +46,7 @@
 
 #include "ole2.h"
 #include "sspi.h"
+#include "wincrypt.h"
 
 static const WCHAR getW[]    = {'G','E','T',0};
 static const WCHAR postW[]   = {'P','O','S','T',0};
@@ -209,6 +210,7 @@ typedef struct
     DWORD optional_len;
     netconn_t *netconn;
     DWORD security_flags;
+    const CERT_CONTEXT *server_cert;
     int resolve_timeout;
     int connect_timeout;
     int send_timeout;
