diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 7c5c28545a..0d1814cda5 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -2195,6 +2195,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 
 #if !TARGET_OS_IPHONE
 exit_or_usage:
+	cleanup_openssl_refs();
 	digexit();
 #endif /* if !TARGET_OS_IPHONE */
 }
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 4bafbf7bae..25c3bdde33 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -227,9 +227,6 @@ clear_current_lookup(void);
 static bool
 next_origin(dig_lookup_t *oldlookup);
 
-static void
-cleanup_openssl_refs(void);
-
 static int
 count_dots(char *string) {
 	char *s;
@@ -4664,7 +4661,7 @@ cancel_all(void) {
 	}
 }
 
-static void
+void
 cleanup_openssl_refs(void) {
 	if (tsigkey != NULL) {
 		debug("freeing TSIG key %p", tsigkey);
diff --git a/bin/dig/dighost.h b/bin/dig/dighost.h
index 06beaa91bc..4c12260338 100644
--- a/bin/dig/dighost.h
+++ b/bin/dig/dighost.h
@@ -296,6 +296,9 @@ warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 noreturn void
 digexit(void);
 
+void
+cleanup_openssl_refs(void);
+
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);