diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
index aa2f5e5..6d7bc26 100644
--- a/crypto/x509/x509_lu.c
+++ b/crypto/x509/x509_lu.c
@@ -410,7 +410,7 @@
 		X509_up_ref(a->data.x509);
 		break;
 	case X509_LU_CRL:
-		CRYPTO_refcount_inc(&a->data.crl->references);
+		X509_CRL_up_ref(a->data.crl);
 		break;
 		}
 	}
@@ -572,7 +572,7 @@
 		{
 		obj = sk_X509_OBJECT_value(ctx->ctx->objs, idx);
 		x = obj->data.crl;
-		CRYPTO_refcount_inc(&x->references);
+		X509_CRL_up_ref(x);
 		if (!sk_X509_CRL_push(sk, x))
 			{
 			CRYPTO_MUTEX_unlock(&ctx->ctx->objs_lock);
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index c22ad34..5d856f0 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -274,7 +274,7 @@
 					OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
 					goto end;
 					}
-				CRYPTO_refcount_inc(&xtmp->references);
+				X509_up_ref(xtmp);
 				(void)sk_X509_delete_ptr(sktmp,xtmp);
 				ctx->last_untrusted++;
 				x=xtmp;
@@ -992,7 +992,7 @@
 		*pissuer = best_crl_issuer;
 		*pscore = best_score;
 		*preasons = best_reasons;
-		CRYPTO_refcount_inc(&best_crl->references);
+		X509_CRL_up_ref(best_crl);
 		if (*pdcrl)
 			{
 			X509_CRL_free(*pdcrl);
@@ -1099,7 +1099,7 @@
 			{
 			if (check_crl_time(ctx, delta, 0))
 				*pscore |= CRL_SCORE_TIME_DELTA;
-			CRYPTO_refcount_inc(&delta->references);
+			X509_CRL_up_ref(delta);
 			*dcrl = delta;
 			return;
 			}
diff --git a/crypto/x509/x509cset.c b/crypto/x509/x509cset.c
index b526c69..82d61d0 100644
--- a/crypto/x509/x509cset.c
+++ b/crypto/x509/x509cset.c
@@ -57,6 +57,8 @@
 #include <openssl/obj.h>
 #include <openssl/x509.h>
 
+#include "../internal.h"
+
 
 int X509_CRL_set_version(X509_CRL *x, long version)
 	{
@@ -128,6 +130,11 @@
 	return 1;
 	}
 
+void X509_CRL_up_ref(X509_CRL *crl)
+	{
+	CRYPTO_refcount_inc(&crl->references);
+	}
+
 int X509_REVOKED_set_revocationDate(X509_REVOKED *x, ASN1_TIME *tm)
 	{
 	ASN1_TIME *in;
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 8871910..f6b3af0 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -896,6 +896,7 @@
 OPENSSL_EXPORT int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm);
 OPENSSL_EXPORT int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm);
 OPENSSL_EXPORT int X509_CRL_sort(X509_CRL *crl);
+OPENSSL_EXPORT void X509_CRL_up_ref(X509_CRL *crl);
 
 OPENSSL_EXPORT int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial);
 OPENSSL_EXPORT int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm);