diff --git a/ssl/tls13_both.c b/ssl/tls13_both.c
index 9bf169d2..17f7161e 100644
--- a/ssl/tls13_both.c
+++ b/ssl/tls13_both.c
@@ -457,7 +457,8 @@ int tls13_prepare_certificate(SSL *ssl) {
     if (!CBB_add_u16(&extensions, TLSEXT_TYPE_certificate_timestamp) ||
         !CBB_add_u16_length_prefixed(&extensions, &contents) ||
         !CBB_add_bytes(&contents, ssl->ctx->signed_cert_timestamp_list,
-                       ssl->ctx->signed_cert_timestamp_list_length)) {
+                       ssl->ctx->signed_cert_timestamp_list_length) ||
+        !CBB_flush(&extensions)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
       goto err;
     }
@@ -471,7 +472,8 @@ int tls13_prepare_certificate(SSL *ssl) {
         !CBB_add_u8(&contents, TLSEXT_STATUSTYPE_ocsp) ||
         !CBB_add_u24_length_prefixed(&contents, &ocsp_response) ||
         !CBB_add_bytes(&ocsp_response, ssl->ctx->ocsp_response,
-                       ssl->ctx->ocsp_response_length)) {
+                       ssl->ctx->ocsp_response_length) ||
+        !CBB_flush(&extensions)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
       goto err;
     }