diff --git a/src/apps.js b/src/apps.js
index e720a9c53..4a213db26 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -2031,7 +2031,7 @@ async function getCertificate(subdomain, domain) {
 
     const result = await database.query('SELECT certificateJson FROM locations WHERE subdomain=? AND domain=?', [ subdomain, domain ]);
     if (result.length === 0) return null;
-    return JSON.parse(result[0].certificateJson);
+    return safe.JSON.parse(result[0].certificateJson);
 }
 
 // does a re-configure when called from most states. for install/clone errors, it re-installs with an optional manifest