diff --git a/x509-ocsp/src/ext.rs b/x509-ocsp/src/ext.rs
index 63eeeb63a..3a6fb413e 100644
--- a/x509-ocsp/src/ext.rs
+++ b/x509-ocsp/src/ext.rs
@@ -75,6 +75,7 @@ impl Nonce {
             rng.fill_bytes(&mut random);
             bytes.extend_from_slice(&random);
         }
+        bytes.resize(length, 0);
         Ok(Self(OctetString::new(bytes)?))
     }
 }