diff --git a/scripts/policy/protocols/ssl/extract-certs-pem.bro b/scripts/policy/protocols/ssl/extract-certs-pem.bro
index f48d4bc369..c64e8f86dc 100644
--- a/scripts/policy/protocols/ssl/extract-certs-pem.bro
+++ b/scripts/policy/protocols/ssl/extract-certs-pem.bro
@@ -39,6 +39,7 @@ event ssl_established(c: connection) &priority=5
 		# If we already extracted this cert, don't do it again.
 		return;
 
+	add extracted_certs[c$ssl$cert_hash];
 	local filename = Site::is_local_addr(c$id$resp_h) ? "certs-local.pem" : "certs-remote.pem";
 	local outfile = open_for_append(filename);