diff --git a/src/lib/rnp.cpp b/src/lib/rnp.cpp
index 89c7f4baae..b54640826a 100644
--- a/src/lib/rnp.cpp
+++ b/src/lib/rnp.cpp
@@ -6090,7 +6090,7 @@ create_key_signature(rnp_ffi_t               ffi,
     }
     sig = (rnp_signature_handle_t) calloc(1, sizeof(*sig));
     if (!sig) {
-        return RNP_ERROR_OUT_OF_MEMORY;
+        return RNP_ERROR_OUT_OF_MEMORY; // LCOV_EXCL_LINE
     }
     try {
         pgp_signature_t sigpkt;
@@ -6104,10 +6104,12 @@ create_key_signature(rnp_ffi_t               ffi,
         sig->own_sig = true;
         sig->new_sig = true;
     } catch (const std::exception &e) {
+        /* LCOV_EXCL_START */
         FFI_LOG(ffi, "%s", e.what());
         free(sig);
         sig = NULL;
         return RNP_ERROR_OUT_OF_MEMORY;
+        /* LCOV_EXCL_END */
     }
 
     return RNP_SUCCESS;
diff --git a/src/tests/ffi-key-sig.cpp b/src/tests/ffi-key-sig.cpp
index ab85293b5b..f656a7163a 100644
--- a/src/tests/ffi-key-sig.cpp
+++ b/src/tests/ffi-key-sig.cpp
@@ -2001,6 +2001,7 @@ TEST_F(rnp_tests, test_ffi_create_self_certification_signature)
       rnp_key_certification_create(key, NULL, RNP_CERTIFICATION_POSITIVE, &newsig));
     assert_rnp_failure(
       rnp_key_certification_create(key, uid, RNP_CERTIFICATION_POSITIVE, NULL));
+    assert_rnp_failure(rnp_key_certification_create(key, uid, "wrong", &newsig));
     assert_rnp_success(rnp_key_certification_create(key, uid, NULL, &newsig));
     const char *hash = "SHA384";
     assert_rnp_success(rnp_key_signature_set_hash(newsig, hash));
@@ -2110,8 +2111,10 @@ TEST_F(rnp_tests, test_ffi_create_key_certification_signature)
     rnp_signature_handle_destroy(newsig);
     assert_rnp_success(rnp_uid_get_signature_at(uid, 2, &newsig));
     assert_rnp_success(rnp_signature_is_valid(newsig, 0));
+    assert_rnp_failure(rnp_key_signature_set_hash(newsig, hash));
     assert_true(check_sig_hash(newsig, hash2));
     assert_true(check_sig_type(newsig, "certification (casual)"));
+    assert_rnp_failure(rnp_key_signature_set_trust_level(newsig, 1, 60));
     assert_rnp_success(rnp_signature_get_trust_level(newsig, &level, &amount));
     assert_int_equal(level, 1);
     assert_int_equal(amount, 120);
@@ -2308,36 +2311,45 @@ TEST_F(rnp_tests, test_ffi_key_self_certification_features)
     uint32_t now = ::time(NULL);
     assert_rnp_failure(rnp_signature_get_creation(NULL, &check));
     assert_rnp_failure(rnp_signature_get_creation(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_set_creation(newsig, 0));
     assert_rnp_success(rnp_signature_get_creation(newsig, &check));
     assert_true(check >= now - 10);
     assert_rnp_failure(rnp_signature_get_key_expiration(NULL, &check));
     assert_rnp_failure(rnp_signature_get_key_expiration(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_set_key_expiration(newsig, 10000));
     assert_rnp_success(rnp_signature_get_key_expiration(newsig, &check));
     assert_int_equal(check, 0);
     assert_rnp_failure(rnp_signature_get_primary_uid(NULL, &primary));
     assert_rnp_failure(rnp_signature_get_primary_uid(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_set_primary_uid(newsig, true));
     assert_rnp_success(rnp_signature_get_primary_uid(newsig, &primary));
     assert_false(primary);
     char *strcheck = NULL;
     assert_rnp_failure(rnp_signature_get_key_server(NULL, &strcheck));
     assert_rnp_failure(rnp_signature_get_key_server(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_set_key_server(newsig, "server"));
     assert_rnp_success(rnp_signature_get_key_server(newsig, &strcheck));
     assert_string_equal(strcheck, "");
     rnp_buffer_destroy(strcheck);
     assert_rnp_failure(rnp_signature_get_features(NULL, &check));
     assert_rnp_failure(rnp_signature_get_features(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_set_features(newsig, features));
     assert_rnp_success(rnp_signature_get_features(newsig, &check));
     assert_int_equal(check, 0);
     assert_rnp_failure(rnp_signature_get_key_flags(NULL, &check));
     assert_rnp_failure(rnp_signature_get_key_flags(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_set_key_flags(newsig, RNP_KEY_USAGE_CERTIFY));
     assert_rnp_success(rnp_signature_get_features(newsig, &check));
     assert_int_equal(check, 0);
     assert_rnp_failure(rnp_signature_get_key_server_prefs(NULL, &check));
     assert_rnp_failure(rnp_signature_get_key_server_prefs(newsig, NULL));
+    assert_rnp_failure(
+      rnp_key_signature_set_key_server_prefs(newsig, RNP_KEY_SERVER_NO_MODIFY));
     assert_rnp_success(rnp_signature_get_key_server_prefs(newsig, &check));
     assert_int_equal(check, 0);
     assert_rnp_failure(rnp_signature_get_preferred_alg_count(NULL, &count));
     assert_rnp_failure(rnp_signature_get_preferred_alg_count(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_add_preferred_alg(newsig, RNP_ALGNAME_AES_256));
     assert_rnp_success(rnp_signature_get_preferred_alg_count(newsig, &count));
     assert_int_equal(count, 0);
     assert_rnp_failure(rnp_signature_get_preferred_alg(NULL, 0, &alg));
@@ -2345,6 +2357,7 @@ TEST_F(rnp_tests, test_ffi_key_self_certification_features)
     assert_rnp_failure(rnp_signature_get_preferred_alg(newsig, 0, &alg));
     assert_rnp_failure(rnp_signature_get_preferred_hash_count(NULL, &count));
     assert_rnp_failure(rnp_signature_get_preferred_hash_count(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_add_preferred_hash(newsig, RNP_ALGNAME_SHA512));
     assert_rnp_success(rnp_signature_get_preferred_hash_count(newsig, &count));
     assert_int_equal(count, 0);
     assert_rnp_failure(rnp_signature_get_preferred_hash(NULL, 0, &alg));
@@ -2352,6 +2365,7 @@ TEST_F(rnp_tests, test_ffi_key_self_certification_features)
     assert_rnp_failure(rnp_signature_get_preferred_hash(newsig, 0, &alg));
     assert_rnp_failure(rnp_signature_get_preferred_zalg_count(NULL, &count));
     assert_rnp_failure(rnp_signature_get_preferred_zalg_count(newsig, NULL));
+    assert_rnp_failure(rnp_key_signature_add_preferred_zalg(newsig, RNP_ALGNAME_BZIP2));
     assert_rnp_success(rnp_signature_get_preferred_zalg_count(newsig, &count));
     assert_int_equal(count, 0);
     assert_rnp_failure(rnp_signature_get_preferred_zalg(NULL, 0, &alg));
diff --git a/src/tests/ffi-key.cpp b/src/tests/ffi-key.cpp
index cd391d7a08..d1fe5c5dc0 100644
--- a/src/tests/ffi-key.cpp
+++ b/src/tests/ffi-key.cpp
@@ -735,6 +735,8 @@ TEST_F(rnp_tests, test_ffi_key_generate_rsa)
     assert_int_equal(uids, 1);
     assert_rnp_failure(rnp_key_get_uid_at(key, 1, &uid));
     assert_null(uid);
+    assert_rnp_failure(rnp_key_get_uid_at(NULL, 0, &uid));
+    assert_rnp_failure(rnp_key_get_uid_at(key, 0, NULL));
     assert_rnp_success(rnp_key_get_uid_at(key, 0, &uid));
     assert_string_equal(uid, "rsa_1024");
     rnp_buffer_destroy(uid);