diff --git a/lib/pk11wrap/pk11cert.c b/lib/pk11wrap/pk11cert.c
index 804db6da98..c1caf5e60b 100644
--- a/lib/pk11wrap/pk11cert.c
+++ b/lib/pk11wrap/pk11cert.c
@@ -765,7 +765,12 @@ find_certs_from_nickname(const char *nickname, void *wincx)
         *delimit = ':';
     } else {
         slot = PK11_GetInternalKeySlot();
-        token = nssToken_AddRef(PK11Slot_GetNSSToken(slot));
+        token = PK11Slot_GetNSSToken(slot);
+        if (token) {
+            nssToken_AddRef(token);
+        } else {
+            PORT_SetError(SEC_ERROR_NO_TOKEN);
+        }
     }
     if (token) {
         nssList *certList;