diff --git a/demos/certs/mkcerts.sh b/demos/certs/mkcerts.sh
index 1825607fa3..89300a6c52 100644
--- a/demos/certs/mkcerts.sh
+++ b/demos/certs/mkcerts.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 opensslcmd() {
-    LD_LIBRARY_PATH=../.. ../../apps/openssl $@
+    LD_LIBRARY_PATH=../.. ../../apps/openssl "$@"
 }
 
 OPENSSL_CONF=../../apps/openssl.cnf
diff --git a/demos/certs/ocspquery.sh b/demos/certs/ocspquery.sh
index 7cb8e76423..b38e10ce2e 100644
--- a/demos/certs/ocspquery.sh
+++ b/demos/certs/ocspquery.sh
@@ -4,7 +4,7 @@
 # called.
 
 opensslcmd() {
-    LD_LIBRARY_PATH=../.. ../../apps/openssl $@
+    LD_LIBRARY_PATH=../.. ../../apps/openssl "$@"
 }
 
 OPENSSL_CONF=../../apps/openssl.cnf
diff --git a/demos/certs/ocsprun.sh b/demos/certs/ocsprun.sh
index 77fd62fcf1..b2e927cd84 100644
--- a/demos/certs/ocsprun.sh
+++ b/demos/certs/ocsprun.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 opensslcmd() {
-    LD_LIBRARY_PATH=../.. ../../apps/openssl $@
+    LD_LIBRARY_PATH=../.. ../../apps/openssl "$@"
 }
 
 # Example of running an querying OpenSSL test OCSP responder.
@@ -18,4 +18,4 @@ opensslcmd version
 PORT=8888
 
 opensslcmd ocsp -port $PORT -index index.txt -CA intca.pem \
-	-rsigner resp.pem -rkey respkey.pem -rother intca.pem $*
+	-rsigner resp.pem -rkey respkey.pem -rother intca.pem "$@"