diff --git a/ChangeLog b/ChangeLog
index e6d544d0d8..c331c17152 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Thu Oct 26 21:05:48 2006  GOTOU Yuuzou  <gotoyuzo@notwork.org>
+
+	* ext/openssl/ossl_pkcs7.c (ossl_pkcs7_verify): should clear error.
+	  (fix http://bugs.debian.org/394336)
+
+	* ext/openssl/ossl_ns_spki.c (ossl_spki_initialize): ditto.
+
 Thu Oct 26 15:23:47 2006  Yukihiro Matsumoto  <matz@ruby-lang.org>
 
 	* enumerator.c: remove by_slice and by_cons.
diff --git a/ext/openssl/ossl_ns_spki.c b/ext/openssl/ossl_ns_spki.c
index 2e0e42aa1a..738a203d93 100644
--- a/ext/openssl/ossl_ns_spki.c
+++ b/ext/openssl/ossl_ns_spki.c
@@ -70,6 +70,7 @@ ossl_spki_initialize(int argc, VALUE *argv, VALUE self)
     }
     NETSCAPE_SPKI_free(DATA_PTR(self));
     DATA_PTR(self) = spki;
+    ERR_clear_error();
 
     return self;
 }
diff --git a/ext/openssl/ossl_pkcs7.c b/ext/openssl/ossl_pkcs7.c
index 8fa2824aad..04dd0d8d30 100644
--- a/ext/openssl/ossl_pkcs7.c
+++ b/ext/openssl/ossl_pkcs7.c
@@ -667,8 +667,10 @@ ossl_pkcs7_verify(int argc, VALUE *argv, VALUE self)
     }
     ok = PKCS7_verify(p7, x509s, x509st, in, out, flg);
     BIO_free(in);
+    if (ok < 0) ossl_raise(ePKCS7Error, NULL);
     msg = ERR_reason_error_string(ERR_get_error());
     ossl_pkcs7_set_err_string(self, msg ? rb_str_new2(msg) : Qnil);
+    ERR_clear_error();
     data = ossl_membio2str(out);
     ossl_pkcs7_set_data(self, data);
     sk_X509_pop_free(x509s, X509_free);