diff --git a/handshake_cache.go b/handshake_cache.go
index 53e9515ab..a4b08c801 100644
--- a/handshake_cache.go
+++ b/handshake_cache.go
@@ -39,7 +39,7 @@ func (h *handshakeCache) push(data []byte, epoch, messageSequence uint16, typ ha
 	defer h.mu.Unlock()
 
 	h.cache = append(h.cache, &handshakeCacheItem{
-		data:            append([]byte{}, data...),
+		data:            data,
 		epoch:           epoch,
 		messageSequence: messageSequence,
 		typ:             typ,
diff --git a/pkg/protocol/handshake/message_certificate.go b/pkg/protocol/handshake/message_certificate.go
index 8da5237fe..1ac82ac83 100644
--- a/pkg/protocol/handshake/message_certificate.go
+++ b/pkg/protocol/handshake/message_certificate.go
@@ -26,22 +26,30 @@ const (
 
 // Marshal encodes the Handshake.
 func (m *MessageCertificate) Marshal() ([]byte, error) {
-	out := make([]byte, handshakeMessageCertificateLengthFieldSize)
+	total := handshakeMessageCertificateLengthFieldSize
 
-	for _, r := range m.Certificate {
+	for _, cert := range m.Certificate {
+		total += handshakeMessageCertificateLengthFieldSize + len(cert)
+	}
+
+	out := make([]byte, total)
+
+	// Total Payload Size
+	//nolint:gosec // G115
+	util.PutBigEndianUint24(out, uint32(total-handshakeMessageCertificateLengthFieldSize))
+	offset := handshakeMessageCertificateLengthFieldSize
+
+	for _, cert := range m.Certificate {
 		// Certificate Length
-		//nolint:makezero // todo: fix
-		out = append(out, make([]byte, handshakeMessageCertificateLengthFieldSize)...)
 		//nolint:gosec // G115
-		util.PutBigEndianUint24(out[len(out)-handshakeMessageCertificateLengthFieldSize:], uint32(len(r)))
+		util.PutBigEndianUint24(out[offset:], uint32(len(cert)))
+		offset += handshakeMessageCertificateLengthFieldSize
 
 		// Certificate body
-		out = append(out, append([]byte{}, r...)...) //nolint:makezero // todo: fix
+		copy(out[offset:], cert)
+		offset += len(cert)
 	}
 
-	// Total Payload Size
-	util.PutBigEndianUint24(out[0:], uint32(len(out[handshakeMessageCertificateLengthFieldSize:]))) //nolint:gosec //G115
-
 	return out, nil
 }