diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 9ff8b4292c..83eb8d1507 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -2207,6 +2207,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 
 #if !TARGET_OS_IPHONE
 exit_or_usage:
+	cleanup_openssl_refs();
 	digexit();
 #endif /* if !TARGET_OS_IPHONE */
 }
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 84cdda915e..f2a897dc05 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -2361,6 +2361,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			clear_current_lookup();
 			return (false);
 #else  /* if TARGET_OS_IPHONE */
+			cleanup_openssl_refs();
 			digexit();
 #endif /* if TARGET_OS_IPHONE */
 		}
@@ -4708,6 +4709,25 @@ cancel_all(void) {
 	UNLOCK_LOOKUP;
 }
 
+void
+cleanup_openssl_refs(void) {
+	if (tsigkey != NULL) {
+		debug("freeing TSIG key %p", tsigkey);
+		dns_tsigkey_detach(&tsigkey);
+	}
+
+	if (sig0key != NULL) {
+		debug("freeing SIG(0) key %p", sig0key);
+		dst_key_free(&sig0key);
+	}
+
+	if (is_dst_up) {
+		debug("destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
+}
+
 /*%
  * Destroy all of the libs we are using, and get everything ready for a
  * clean shutdown.
@@ -4739,29 +4759,16 @@ destroy_libs(void) {
 
 	clear_searchlist();
 
-	if (tsigkey != NULL) {
-		debug("freeing TSIG key %p", tsigkey);
-		dns_tsigkey_detach(&tsigkey);
-	}
-
-	if (sig0key != NULL) {
-		debug("freeing SIG(0) key %p", sig0key);
-		dst_key_free(&sig0key);
-	}
+	cleanup_openssl_refs();
 
 	if (namebuf != NULL) {
 		debug("freeing key %p", tsigkey);
 		isc_buffer_free(&namebuf);
 	}
 
-	if (is_dst_up) {
-		debug("destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
-
 	UNLOCK_LOOKUP;
 	isc_mutex_destroy(&lookup_lock);
+
 	debug("Removing log context");
 	isc_log_destroy(&lctx);
 
diff --git a/bin/dig/dighost.h b/bin/dig/dighost.h
index 593468a049..227c315f51 100644
--- a/bin/dig/dighost.h
+++ b/bin/dig/dighost.h
@@ -295,6 +295,9 @@ warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 noreturn void
 digexit(void);
 
+void
+cleanup_openssl_refs(void);
+
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);