diff --git a/client/client.go b/client/client.go
index ba5b9004cf4a3c85c8803d3585f99a55bea0aca3..e69f3534bb520b0fd6ea8ddecd14db58ea8e436b 100644
--- a/client/client.go
+++ b/client/client.go
@@ -5,7 +5,6 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"path"
@@ -67,12 +66,8 @@ func send(s []byte, token, ca string, ValidateTLSCertificate bool) (*lib.SignRes
 		return nil, fmt.Errorf("Bad response from server: %s", resp.Status)
 	}
 	defer resp.Body.Close()
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
 	c := &lib.SignResponse{}
-	if err := json.Unmarshal(body, c); err != nil {
+	if err := json.NewDecoder(resp.Body).Decode(c); err != nil {
 		return nil, err
 	}
 	return c, nil
diff --git a/cmd/cashierd/handlers_test.go b/cmd/cashierd/handlers_test.go
index 38251ce7e2d3bd6a0493f688d7c8382740cef5c7..a6bd113644fe7777457078e84b881db80d770f6e 100644
--- a/cmd/cashierd/handlers_test.go
+++ b/cmd/cashierd/handlers_test.go
@@ -114,12 +114,8 @@ func TestSignRevoke(t *testing.T) {
 	if resp.Code != http.StatusOK {
 		t.Error("Unexpected response")
 	}
-	b, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		t.Error(err)
-	}
 	r := &lib.SignResponse{}
-	if err := json.Unmarshal(b, r); err != nil {
+	if err := json.NewDecoder(resp.Body).Decode(r); err != nil {
 		t.Error(err)
 	}
 	if r.Status != "ok" {
diff --git a/cmd/cashierd/main.go b/cmd/cashierd/main.go
index 6e52ddfaed056420fb1e7d53c62d6cceb3c1eedc..88f190e44f2f8e4c48772f274406658b02bc0100 100644
--- a/cmd/cashierd/main.go
+++ b/cmd/cashierd/main.go
@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"html/template"
 	"io"
-	"io/ioutil"
 	"log"
 	"net"
 	"net/http"
@@ -125,11 +124,7 @@ func (a *appContext) login(w http.ResponseWriter, r *http.Request) (int, error)
 // parseKey retrieves and unmarshals the signing request.
 func parseKey(r *http.Request) (*lib.SignRequest, error) {
 	var s lib.SignRequest
-	body, err := ioutil.ReadAll(r.Body)
-	if err != nil {
-		return nil, err
-	}
-	if err := json.Unmarshal(body, &s); err != nil {
+	if err := json.NewDecoder(r.Body).Decode(&s); err != nil {
 		return nil, err
 	}
 	return &s, nil
diff --git a/server/store/sqldb.go b/server/store/sqldb.go
index 81784b0268777e91ecb6e30645198f4ec78358a3..f65f60150ae9880aab5a1d096246014e928bf980 100644
--- a/server/store/sqldb.go
+++ b/server/store/sqldb.go
@@ -132,7 +132,7 @@ func (db *sqldb) SetRecord(rec *CertRecord) error {
 	if err := db.conn.Ping(); err != nil {
 		return err
 	}
-	_, err = db.set.Exec(rec.KeyID, string(principals), rec.CreatedAt, rec.Expires, rec.Raw)
+	_, err = db.set.Exec(rec.KeyID, principals, rec.CreatedAt, rec.Expires, rec.Raw)
 	return err
 }