diff --git a/lib/verify.go b/lib/verify.go
index 549f728..2843039 100644
--- a/lib/verify.go
+++ b/lib/verify.go
@@ -88,6 +88,7 @@ func caBundle(caPath string) (*x509.CertPool, error) {
 	if err != nil {
 		return nil, fmt.Errorf("error opening CA bundle %s: %s\n", caPath, err)
 	}
+	defer caFile.Close()
 
 	bundle := x509.NewCertPool()
 	err = ReadAsX509FromFiles(