diff --git a/ssl/internal.h b/ssl/internal.h
index ade94162b..4f1345999 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -906,9 +906,6 @@ struct ssl_handshake_st {
   uint8_t *public_key;
   size_t public_key_len;
 
-  uint8_t *cert_context;
-  size_t cert_context_len;
-
   uint8_t session_tickets_sent;
 } /* SSL_HANDSHAKE */;
 
diff --git a/ssl/test/runner/common.go b/ssl/test/runner/common.go
index 2b4f53d5e..319ae2833 100644
--- a/ssl/test/runner/common.go
+++ b/ssl/test/runner/common.go
@@ -1049,6 +1049,10 @@ type ProtocolBugs struct {
 	// SendExtraFinished, if true, causes an extra Finished message to be
 	// sent.
 	SendExtraFinished bool
+
+	// SendRequestContext, if not empty, is the request context to send in
+	// a TLS 1.3 CertificateRequest.
+	SendRequestContext []byte
 }
 
 func (c *Config) serverInit() {
diff --git a/ssl/test/runner/handshake_client.go b/ssl/test/runner/handshake_client.go
index 91afc6418..e8e64905c 100644
--- a/ssl/test/runner/handshake_client.go
+++ b/ssl/test/runner/handshake_client.go
@@ -673,6 +673,10 @@ func (hs *clientHandshakeState) doTLS13Handshake() error {
 		var ok bool
 		certReq, ok = msg.(*certificateRequestMsg)
 		if ok {
+			if len(certReq.requestContext) != 0 {
+				return errors.New("tls: non-empty certificate request context sent in handshake")
+			}
+
 			if c.config.Bugs.IgnorePeerSignatureAlgorithmPreferences {
 				certReq.signatureAlgorithms = c.config.signSignatureAlgorithms()
 			}
diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go
index 64e2a71e0..6d4d70a17 100644
--- a/ssl/test/runner/handshake_server.go
+++ b/ssl/test/runner/handshake_server.go
@@ -596,6 +596,7 @@ Curves:
 			certReq := &certificateRequestMsg{
 				hasSignatureAlgorithm: true,
 				hasRequestContext:     true,
+				requestContext:        config.Bugs.SendRequestContext,
 			}
 			if !config.Bugs.NoSignatureAlgorithms {
 				certReq.signatureAlgorithms = config.verifySignatureAlgorithms()
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 71278ae39..f999f480d 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -3125,7 +3125,7 @@ func addStateMachineCoverageTests(config stateMachineTestConfig) {
 				MaxVersion: VersionTLS13,
 				MinVersion: VersionTLS13,
 			},
-			resumeSession:        true,
+			resumeSession: true,
 		})
 
 		tests = append(tests, testCase{
@@ -3135,7 +3135,7 @@ func addStateMachineCoverageTests(config stateMachineTestConfig) {
 				MaxVersion: VersionTLS13,
 				MinVersion: VersionTLS13,
 			},
-			resumeSession:        true,
+			resumeSession: true,
 		})
 
 		tests = append(tests, testCase{
@@ -8007,6 +8007,24 @@ func addTLS13HandshakeTests() {
 		shouldFail:    true,
 		expectedError: ":WRONG_CURVE:",
 	})
+
+	testCases = append(testCases, testCase{
+		name: "TLS13-RequestContextInHandshake",
+		config: Config{
+			MaxVersion: VersionTLS13,
+			MinVersion: VersionTLS13,
+			ClientAuth: RequireAnyClientCert,
+			Bugs: ProtocolBugs{
+				SendRequestContext: []byte("request context"),
+			},
+		},
+		flags: []string{
+			"-cert-file", path.Join(*resourceDir, rsaCertificateFile),
+			"-key-file", path.Join(*resourceDir, rsaKeyFile),
+		},
+		shouldFail:    true,
+		expectedError: ":DECODE_ERROR:",
+	})
 }
 
 func worker(statusChan chan statusMsg, c chan *testCase, shimPath string, wg *sync.WaitGroup) {
diff --git a/ssl/tls13_both.c b/ssl/tls13_both.c
index 25278969a..9dd27cef0 100644
--- a/ssl/tls13_both.c
+++ b/ssl/tls13_both.c
@@ -63,7 +63,6 @@ void ssl_handshake_free(SSL_HANDSHAKE *hs) {
   ssl_handshake_clear_groups(hs);
   OPENSSL_free(hs->key_share_bytes);
   OPENSSL_free(hs->public_key);
-  OPENSSL_free(hs->cert_context);
   OPENSSL_free(hs);
 }
 
@@ -329,11 +328,10 @@ int tls13_process_finished(SSL *ssl) {
 }
 
 int tls13_prepare_certificate(SSL *ssl) {
-  CBB cbb, body, context;
+  CBB cbb, body;
   if (!ssl->method->init_message(ssl, &cbb, &body, SSL3_MT_CERTIFICATE) ||
-      !CBB_add_u8_length_prefixed(&body, &context) ||
-      !CBB_add_bytes(&context, ssl->s3->hs->cert_context,
-                     ssl->s3->hs->cert_context_len) ||
+      /* The request context is always empty in the handshake. */
+      !CBB_add_u8(&body, 0) ||
       !ssl_add_cert_chain(ssl, &body) ||
       !ssl->method->finish_message(ssl, &cbb)) {
     CBB_cleanup(&cbb);
diff --git a/ssl/tls13_client.c b/ssl/tls13_client.c
index d58f72d9e..d2d99a7aa 100644
--- a/ssl/tls13_client.c
+++ b/ssl/tls13_client.c
@@ -394,8 +394,8 @@ static enum ssl_hs_wait_t do_process_certificate_request(SSL *ssl,
   CBS cbs, context, supported_signature_algorithms;
   CBS_init(&cbs, ssl->init_msg, ssl->init_num);
   if (!CBS_get_u8_length_prefixed(&cbs, &context) ||
-      !CBS_stow(&context, &ssl->s3->hs->cert_context,
-                &ssl->s3->hs->cert_context_len) ||
+      /* The request context is always empty during the handshake. */
+      CBS_len(&context) != 0 ||
       !CBS_get_u16_length_prefixed(&cbs, &supported_signature_algorithms) ||
       CBS_len(&supported_signature_algorithms) == 0 ||
       !tls1_parse_peer_sigalgs(ssl, &supported_signature_algorithms)) {