diff --git a/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst
new file mode 100644
index 000000000000000..2d723061b9369d8
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst
@@ -0,0 +1,2 @@
+Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup
+fails.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 90bcb6fd5dc6aca..f1b99168fcd29d4 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -1512,6 +1512,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) {
 
 
   fail:
+    sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
     if (biobuf != NULL)
         BIO_free(biobuf);
 
diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c
index 177019ea985af61..b15caa1084deb6d 100644
--- a/Modules/_ssl/debughelpers.c
+++ b/Modules/_ssl/debughelpers.c
@@ -220,6 +220,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
 
     self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT);
     if (self->keylog_bio == NULL) {
+        fclose(fp);
         PyErr_SetString(get_state_ctx(self)->PySSLErrorObject,
                         "Can't malloc memory for keylog file");
         return -1;