diff --git a/src/io.c b/src/io.c
index d9ae0596a..dfcfb19eb 100644
--- a/src/io.c
+++ b/src/io.c
@@ -976,12 +976,13 @@ int EmbedOcspLookup(void* ctx, const char* url, int urlSz,
 }
 
 
+/* in default callback ctx is heap hint */
 void EmbedOcspRespFree(void* ctx, byte *resp)
 {
-    (void)ctx;
-
     if (resp)
-        XFREE(resp, NULL, DYNAMIC_TYPE_OCSP);
+        XFREE(resp, ctx, DYNAMIC_TYPE_OCSP);
+
+    (void)ctx;
 }
 
 
diff --git a/src/ocsp.c b/src/ocsp.c
index c1c0b59c5..80dc2c072 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -71,7 +71,7 @@ static int InitOcspEntry(OcspEntry* entry, OcspRequest* request)
 }
 
 
-static void FreeOcspEntry(OcspEntry* entry)
+static void FreeOcspEntry(OcspEntry* entry, void* heap)
 {
     CertStatus *status, *next;
 
@@ -81,10 +81,12 @@ static void FreeOcspEntry(OcspEntry* entry)
         next = status->next;
 
         if (status->rawOcspResponse)
-            XFREE(status->rawOcspResponse, NULL, DYNAMIC_TYPE_OCSP_STATUS);
+            XFREE(status->rawOcspResponse, heap, DYNAMIC_TYPE_OCSP_STATUS);
 
-        XFREE(status, NULL, DYNAMIC_TYPE_OCSP_STATUS);
+        XFREE(status, heap, DYNAMIC_TYPE_OCSP_STATUS);
     }
+
+    (void)heap;
 }
 
 
@@ -96,7 +98,7 @@ void FreeOCSP(WOLFSSL_OCSP* ocsp, int dynamic)
 
     for (entry = ocsp->ocspList; entry; entry = next) {
         next = entry->next;
-        FreeOcspEntry(entry);
+        FreeOcspEntry(entry, ocsp->cm->heap);
         XFREE(entry, ocsp->cm->heap, DYNAMIC_TYPE_OCSP_ENTRY);
     }
 
diff --git a/src/ssl.c b/src/ssl.c
index 458865b7c..3c1498b37 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -4471,6 +4471,7 @@ int wolfSSL_CertManagerEnableOCSPStapling(WOLFSSL_CERT_MANAGER* cm)
         #ifndef WOLFSSL_USER_IO
             cm->ocspIOCb = EmbedOcspLookup;
             cm->ocspRespFreeCb = EmbedOcspRespFree;
+            cm->ocspIOCtx = cm->heap;
         #endif /* WOLFSSL_USER_IO */
     #else
         ret = NOT_COMPILED_IN;