diff --git a/ChangeLog b/ChangeLog
index a4fd191dc..28fd64888 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -14,6 +14,7 @@ Bugfix
    * Server does not send out extensions not advertised by client
    * Prevent possible alignment warnings on casting from char * to 'aligned *'
    * Misc fixes and additions to dependency checks
+   * Const correctness
 
 = PolarSSL 1.3.1 released on 2013-10-15
 Features
diff --git a/include/polarssl/x509.h b/include/polarssl/x509.h
index e7472c43f..a45653770 100644
--- a/include/polarssl/x509.h
+++ b/include/polarssl/x509.h
@@ -265,7 +265,7 @@ int x509_get_ext( unsigned char **p, const unsigned char *end,
                   x509_buf *ext, int tag );
 int x509_load_file( const char *path, unsigned char **buf, size_t *n );
 int x509_key_size_helper( char *buf, size_t size, const char *name );
-int x509_string_to_names( asn1_named_data **head, char *name );
+int x509_string_to_names( asn1_named_data **head, const char *name );
 int x509_set_extension( asn1_named_data **head, const char *oid, size_t oid_len,                       int critical, const unsigned char *val, size_t val_len );
 int x509_write_extensions( unsigned char **p, unsigned char *start,
                            asn1_named_data *first );
diff --git a/include/polarssl/x509_crt.h b/include/polarssl/x509_crt.h
index a55667607..a5ab1789a 100644
--- a/include/polarssl/x509_crt.h
+++ b/include/polarssl/x509_crt.h
@@ -312,8 +312,8 @@ int x509write_crt_set_serial( x509write_cert *ctx, const mpi *serial );
  * \return          0 if timestamp was parsed successfully, or
  *                  a specific error code
  */
-int x509write_crt_set_validity( x509write_cert *ctx, char *not_before,
-                                char *not_after );
+int x509write_crt_set_validity( x509write_cert *ctx, const char *not_before,
+                                const char *not_after );
 
 /**
  * \brief           Set the issuer name for a Certificate
@@ -327,7 +327,8 @@ int x509write_crt_set_validity( x509write_cert *ctx, char *not_before,
  * \return          0 if issuer name was parsed successfully, or
  *                  a specific error code
  */
-int x509write_crt_set_issuer_name( x509write_cert *ctx, char *issuer_name );
+int x509write_crt_set_issuer_name( x509write_cert *ctx,
+                                   const char *issuer_name );
 
 /**
  * \brief           Set the subject name for a Certificate
@@ -341,7 +342,8 @@ int x509write_crt_set_issuer_name( x509write_cert *ctx, char *issuer_name );
  * \return          0 if subject name was parsed successfully, or
  *                  a specific error code
  */
-int x509write_crt_set_subject_name( x509write_cert *ctx, char *subject_name );
+int x509write_crt_set_subject_name( x509write_cert *ctx,
+                                    const char *subject_name );
 
 /**
  * \brief           Set the subject public key for the certificate
diff --git a/include/polarssl/x509_csr.h b/include/polarssl/x509_csr.h
index 30ef7c592..7e3830087 100644
--- a/include/polarssl/x509_csr.h
+++ b/include/polarssl/x509_csr.h
@@ -155,7 +155,8 @@ void x509write_csr_init( x509write_csr *ctx );
  * \return          0 if subject name was parsed successfully, or
  *                  a specific error code
  */
-int x509write_csr_set_subject_name( x509write_csr *ctx, char *subject_name );
+int x509write_csr_set_subject_name( x509write_csr *ctx,
+                                    const char *subject_name );
 
 /**
  * \brief           Set the key for a CSR (public key will be included,
diff --git a/library/x509_create.c b/library/x509_create.c
index 4a15e7d17..cc7f9549a 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -31,11 +31,11 @@
 #include "polarssl/asn1write.h"
 #include "polarssl/oid.h"
 
-int x509_string_to_names( asn1_named_data **head, char *name )
+int x509_string_to_names( asn1_named_data **head, const char *name )
 {
     int ret = 0;
-    char *s = name, *c = s;
-    char *end = s + strlen( s );
+    const char *s = name, *c = s;
+    const char *end = s + strlen( s );
     const char *oid = NULL;
     int in_tag = 1;
     asn1_named_data *cur;
diff --git a/library/x509write_crt.c b/library/x509write_crt.c
index 86b403421..15a1194ed 100644
--- a/library/x509write_crt.c
+++ b/library/x509write_crt.c
@@ -81,12 +81,14 @@ void x509write_crt_set_issuer_key( x509write_cert *ctx, pk_context *key )
     ctx->issuer_key = key;
 }
 
-int x509write_crt_set_subject_name( x509write_cert *ctx, char *subject_name )
+int x509write_crt_set_subject_name( x509write_cert *ctx,
+                                    const char *subject_name )
 {
     return x509_string_to_names( &ctx->subject, subject_name );
 }
 
-int x509write_crt_set_issuer_name( x509write_cert *ctx, char *issuer_name )
+int x509write_crt_set_issuer_name( x509write_cert *ctx,
+                                   const char *issuer_name )
 {
     return x509_string_to_names( &ctx->issuer, issuer_name );
 }
@@ -101,8 +103,8 @@ int x509write_crt_set_serial( x509write_cert *ctx, const mpi *serial )
     return( 0 );
 }
 
-int x509write_crt_set_validity( x509write_cert *ctx, char *not_before,
-                                char *not_after )
+int x509write_crt_set_validity( x509write_cert *ctx, const char *not_before,
+                                const char *not_after )
 {
     if( strlen(not_before) != X509_RFC5280_UTC_TIME_LEN - 1 ||
         strlen(not_after)  != X509_RFC5280_UTC_TIME_LEN - 1 )
diff --git a/library/x509write_csr.c b/library/x509write_csr.c
index febed67d2..3a49aee94 100644
--- a/library/x509write_csr.c
+++ b/library/x509write_csr.c
@@ -66,7 +66,8 @@ void x509write_csr_set_key( x509write_csr *ctx, pk_context *key )
     ctx->key = key;
 }
 
-int x509write_csr_set_subject_name( x509write_csr *ctx, char *subject_name )
+int x509write_csr_set_subject_name( x509write_csr *ctx,
+                                    const char *subject_name )
 {
     return x509_string_to_names( &ctx->subject, subject_name );
 }