diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
index 6dfd51ffa2..1e7c503d8f 100644
--- a/lib/isc/pk11.c
+++ b/lib/isc/pk11.c
@@ -800,9 +800,13 @@ push_attribute(pk11_object_t *obj, isc_mem_t *mctx, size_t len) {
 	CK_ATTRIBUTE *attr;
 	CK_BYTE cnt = obj->attrcnt;
 
+	REQUIRE(old != NULL || cnt == 0);
+
 	obj->repr = isc_mem_get(mctx, (cnt + 1) * sizeof(*attr));
 	memset(obj->repr, 0, (cnt + 1) * sizeof(*attr));
-	memmove(obj->repr, old, cnt * sizeof(*attr));
+	if (old != NULL) {
+		memmove(obj->repr, old, cnt * sizeof(*attr));
+	}
 	attr = obj->repr + cnt;
 	attr->ulValueLen = (CK_ULONG) len;
 	attr->pValue = isc_mem_get(mctx, len);