diff --git a/programs/pkey/dh_client.c b/programs/pkey/dh_client.c
index 02e93d34f..34956b817 100644
--- a/programs/pkey/dh_client.c
+++ b/programs/pkey/dh_client.c
@@ -70,7 +70,7 @@ int main( int argc, char *argv[] )
     unsigned char *p, *end;
     unsigned char buf[2048];
     unsigned char hash[20];
-    char *pers = "dh_client";
+    const char *pers = "dh_client";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -92,7 +92,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/pkey/dh_genprime.c b/programs/pkey/dh_genprime.c
index 94f1c621f..5732f507e 100644
--- a/programs/pkey/dh_genprime.c
+++ b/programs/pkey/dh_genprime.c
@@ -62,7 +62,7 @@ int main( int argc, char *argv[] )
     mpi G, P, Q;
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
-    char *pers = "dh_genprime";
+    const char *pers = "dh_genprime";
     FILE *fout;
 
     ((void) argc);
@@ -83,7 +83,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/pkey/dh_server.c b/programs/pkey/dh_server.c
index 1c917c1d1..1eba8061e 100644
--- a/programs/pkey/dh_server.c
+++ b/programs/pkey/dh_server.c
@@ -71,7 +71,7 @@ int main( int argc, char *argv[] )
     unsigned char buf[2048];
     unsigned char hash[20];
     unsigned char buf2[2];
-    char *pers = "dh_server";
+    const char *pers = "dh_server";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -93,7 +93,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/pkey/key_app.c b/programs/pkey/key_app.c
index ebe94a76f..fc0269e28 100644
--- a/programs/pkey/key_app.c
+++ b/programs/pkey/key_app.c
@@ -53,9 +53,9 @@
 struct options
 {
     int mode;                   /* the mode to run the application in   */
-    char *filename;             /* filename of the key file             */
-    char *password;             /* password for the private key         */
-    char *password_file;        /* password_file for the private key    */
+    const char *filename;       /* filename of the key file             */
+    const char *password;       /* password for the private key         */
+    const char *password_file;  /* password_file for the private key    */
     int debug_level;            /* level of debugging                   */
 } opt;
 
diff --git a/programs/pkey/key_app_writer.c b/programs/pkey/key_app_writer.c
index 8c384c893..746da0c4f 100644
--- a/programs/pkey/key_app_writer.c
+++ b/programs/pkey/key_app_writer.c
@@ -72,10 +72,10 @@ int main( int argc, char *argv[] )
 struct options
 {
     int mode;                   /* the mode to run the application in   */
-    char *filename;             /* filename of the key file             */
+    const char *filename;       /* filename of the key file             */
     int debug_level;            /* level of debugging                   */
     int output_mode;            /* the output mode to use               */
-    char *output_file;          /* where to store the constructed key file  */
+    const char *output_file;    /* where to store the constructed key file  */
 } opt;
 
 void my_debug( void *ctx, int level, const char *str )
@@ -87,7 +87,7 @@ void my_debug( void *ctx, int level, const char *str )
     }
 }
 
-void write_public_key( rsa_context *rsa, char *output_file )
+void write_public_key( rsa_context *rsa, const char *output_file )
 {
     FILE *f;
     unsigned char output_buf[16000];
@@ -124,7 +124,7 @@ void write_public_key( rsa_context *rsa, char *output_file )
     fclose(f);
 }
 
-void write_private_key( rsa_context *rsa, char *output_file )
+void write_private_key( rsa_context *rsa, const char *output_file )
 {
     FILE *f;
     unsigned char output_buf[16000];
diff --git a/programs/pkey/rsa_encrypt.c b/programs/pkey/rsa_encrypt.c
index aa6ca0e27..83dcef2df 100644
--- a/programs/pkey/rsa_encrypt.c
+++ b/programs/pkey/rsa_encrypt.c
@@ -60,7 +60,7 @@ int main( int argc, char *argv[] )
     ctr_drbg_context ctr_drbg;
     unsigned char input[1024];
     unsigned char buf[512];
-    char *pers = "rsa_encrypt";
+    const char *pers = "rsa_encrypt";
 
     ret = 1;
 
@@ -80,7 +80,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/pkey/rsa_genkey.c b/programs/pkey/rsa_genkey.c
index 424097e03..68e33e56f 100644
--- a/programs/pkey/rsa_genkey.c
+++ b/programs/pkey/rsa_genkey.c
@@ -62,7 +62,7 @@ int main( int argc, char *argv[] )
     ctr_drbg_context ctr_drbg;
     FILE *fpub  = NULL;
     FILE *fpriv = NULL;
-    char *pers = "rsa_genkey";
+    const char *pers = "rsa_genkey";
 
     ((void) argc);
     ((void) argv);
@@ -72,7 +72,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/pkey/rsa_sign_pss.c b/programs/pkey/rsa_sign_pss.c
index e5fce5753..82387080d 100644
--- a/programs/pkey/rsa_sign_pss.c
+++ b/programs/pkey/rsa_sign_pss.c
@@ -69,7 +69,7 @@ int main( int argc, char *argv[] )
     unsigned char hash[20];
     unsigned char buf[POLARSSL_MPI_MAX_SIZE];
     char filename[512];
-    char *pers = "rsa_sign_pss";
+    const char *pers = "rsa_sign_pss";
 
     ret = 1;
 
@@ -89,7 +89,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/random/gen_random_ctr_drbg.c b/programs/random/gen_random_ctr_drbg.c
index cb4659359..fcdc2eec1 100644
--- a/programs/random/gen_random_ctr_drbg.c
+++ b/programs/random/gen_random_ctr_drbg.c
@@ -61,7 +61,7 @@ int main( int argc, char *argv[] )
     }
 
     entropy_init( &entropy );
-    ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (unsigned char *) "RANDOM_GEN", 10 );
+    ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) "RANDOM_GEN", 10 );
     if( ret != 0 )
     {
         printf( "failed in ctr_drbg_init: %d\n", ret );
diff --git a/programs/ssl/ssl_client1.c b/programs/ssl/ssl_client1.c
index b69c78ea1..8c990238b 100644
--- a/programs/ssl/ssl_client1.c
+++ b/programs/ssl/ssl_client1.c
@@ -75,7 +75,7 @@ int main( int argc, char *argv[] )
 {
     int ret, len, server_fd;
     unsigned char buf[1024];
-    char *pers = "ssl_client1";
+    const char *pers = "ssl_client1";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -96,7 +96,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
@@ -111,7 +112,7 @@ int main( int argc, char *argv[] )
     fflush( stdout );
 
 #if defined(POLARSSL_CERTS_C)
-    ret = x509parse_crt( &cacert, (unsigned char *) test_ca_crt,
+    ret = x509parse_crt( &cacert, (const unsigned char *) test_ca_crt,
                          strlen( test_ca_crt ) );
 #else
     ret = 1;
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index f4cbe00d6..214733b65 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -65,16 +65,16 @@
  */
 struct options
 {
-    char *server_name;          /* hostname of the server (client only)     */
+    const char *server_name;    /* hostname of the server (client only)     */
     int server_port;            /* port on which the ssl service runs       */
     int debug_level;            /* level of debugging                       */
-    char *request_page;         /* page on server to request                */
-    char *ca_file;              /* the file with the CA certificate(s)      */
-    char *ca_path;              /* the path with the CA certificate(s) reside */
-    char *crt_file;             /* the file with the client certificate     */
-    char *key_file;             /* the file with the client key             */
-    char *psk;                  /* the pre-shared key                       */
-    char *psk_identity;         /* the pre-shared key identity              */
+    const char *request_page;   /* page on server to request                */
+    const char *ca_file;        /* the file with the CA certificate(s)      */
+    const char *ca_path;        /* the path with the CA certificate(s) reside */
+    const char *crt_file;       /* the file with the client certificate     */
+    const char *key_file;       /* the file with the client key             */
+    const char *psk;            /* the pre-shared key                       */
+    const char *psk_identity;   /* the pre-shared key identity              */
     int force_ciphersuite[2];   /* protocol/ciphersuite to use, or all      */
     int renegotiation;          /* enable / disable renegotiation           */
     int allow_legacy;           /* allow legacy renegotiation               */
@@ -203,7 +203,7 @@ int main( int argc, char *argv[] )
     unsigned char psk[256];
     size_t psk_len = 0;
 #endif
-    char *pers = "ssl_client2";
+    const char *pers = "ssl_client2";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -449,7 +449,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned -0x%x\n", -ret );
         goto exit;
@@ -472,7 +473,7 @@ int main( int argc, char *argv[] )
     else
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_crt( &cacert, (unsigned char *) test_ca_crt,
+        ret = x509parse_crt( &cacert, (const unsigned char *) test_ca_crt,
                 strlen( test_ca_crt ) );
 #else
     {
@@ -502,7 +503,7 @@ int main( int argc, char *argv[] )
     else
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_crt( &clicert, (unsigned char *) test_cli_crt,
+        ret = x509parse_crt( &clicert, (const unsigned char *) test_cli_crt,
                 strlen( test_cli_crt ) );
 #else
     {
@@ -522,7 +523,7 @@ int main( int argc, char *argv[] )
     else
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_key( &rsa, (unsigned char *) test_cli_key,
+        ret = x509parse_key( &rsa, (const unsigned char *) test_cli_key,
                 strlen( test_cli_key ), NULL, 0 );
 #else
     {
diff --git a/programs/ssl/ssl_fork_server.c b/programs/ssl/ssl_fork_server.c
index d90c3fee9..89f834aad 100644
--- a/programs/ssl/ssl_fork_server.c
+++ b/programs/ssl/ssl_fork_server.c
@@ -97,7 +97,7 @@ int main( int argc, char *argv[] )
     int listen_fd;
     int client_fd;
     unsigned char buf[1024];
-    char *pers = "ssl_fork_server";
+    const char *pers = "ssl_fork_server";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -118,7 +118,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                    (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
@@ -139,7 +140,7 @@ int main( int argc, char *argv[] )
      * Instead, you may want to use x509parse_crtfile() to read the
      * server and CA certificates, as well as x509parse_keyfile().
      */
-    ret = x509parse_crt( &srvcert, (unsigned char *) test_srv_crt,
+    ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt,
                          strlen( test_srv_crt ) );
     if( ret != 0 )
     {
@@ -147,7 +148,7 @@ int main( int argc, char *argv[] )
         goto exit;
     }
 
-    ret = x509parse_crt( &srvcert, (unsigned char *) test_ca_crt,
+    ret = x509parse_crt( &srvcert, (const unsigned char *) test_ca_crt,
                          strlen( test_ca_crt ) );
     if( ret != 0 )
     {
@@ -156,7 +157,7 @@ int main( int argc, char *argv[] )
     }
 
     rsa_init( &rsa, RSA_PKCS_V15, 0 );
-    ret =  x509parse_key( &rsa, (unsigned char *) test_srv_key,
+    ret =  x509parse_key( &rsa, (const unsigned char *) test_srv_key,
                           strlen( test_srv_key ), NULL, 0 );
     if( ret != 0 )
     {
@@ -219,7 +220,8 @@ int main( int argc, char *argv[] )
         if( pid != 0 )
         {
             if( ( ret = ctr_drbg_reseed( &ctr_drbg,
-                                         (unsigned char* ) "parent", 6 ) ) != 0 )
+                                         (const unsigned char *) "parent",
+                                         6 ) ) != 0 )
             {
                 printf( " failed\n  ! ctr_drbg_reseed returned %d\n", ret );
                 goto exit;
@@ -238,7 +240,8 @@ int main( int argc, char *argv[] )
         fflush( stdout );
 
         if( ( ret = ctr_drbg_reseed( &ctr_drbg,
-                                     (unsigned char *) "child", 5 ) ) != 0 )
+                                     (const unsigned char *) "child",
+                                     5 ) ) != 0 )
         {
             printf( " failed\n  ! ctr_drbg_reseed returned %d\n", ret );
             goto exit;
diff --git a/programs/ssl/ssl_mail_client.c b/programs/ssl/ssl_mail_client.c
index a2434bbb4..249b99c56 100644
--- a/programs/ssl/ssl_mail_client.c
+++ b/programs/ssl/ssl_mail_client.c
@@ -77,18 +77,18 @@
  */
 struct options
 {
-    char *server_name;          /* hostname of the server (client only)     */
+    const char *server_name;    /* hostname of the server (client only)     */
     int server_port;            /* port on which the ssl service runs       */
     int debug_level;            /* level of debugging                       */
     int authentication;         /* if authentication is required            */
     int mode;                   /* SSL/TLS (0) or STARTTLS (1)              */
-    char *user_name;            /* username to use for authentication       */
-    char *user_pwd;             /* password to use for authentication       */
-    char *mail_from;            /* E-Mail address to use as sender          */
-    char *mail_to;              /* E-Mail address to use as recipient       */
-    char *ca_file;              /* the file with the CA certificate(s)      */
-    char *crt_file;             /* the file with the client certificate     */
-    char *key_file;             /* the file with the client key             */
+    const char *user_name;      /* username to use for authentication       */
+    const char *user_pwd;       /* password to use for authentication       */
+    const char *mail_from;      /* E-Mail address to use as sender          */
+    const char *mail_to;        /* E-Mail address to use as recipient       */
+    const char *ca_file;        /* the file with the CA certificate(s)      */
+    const char *crt_file;       /* the file with the client certificate     */
+    const char *key_file;       /* the file with the client key             */
     int force_ciphersuite[2];   /* protocol/ciphersuite to use, or all      */
 } opt;
 
@@ -345,7 +345,7 @@ int main( int argc, char *argv[] )
     unsigned char base[1024];
 #endif
     char hostname[32];
-    char *pers = "ssl_mail_client";
+    const char *pers = "ssl_mail_client";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -465,7 +465,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
@@ -485,7 +486,7 @@ int main( int argc, char *argv[] )
     else
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_crt( &cacert, (unsigned char *) test_ca_crt,
+        ret = x509parse_crt( &cacert, (const unsigned char *) test_ca_crt,
                 strlen( test_ca_crt ) );
 #else
     {
@@ -515,7 +516,7 @@ int main( int argc, char *argv[] )
     else 
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_crt( &clicert, (unsigned char *) test_cli_crt,
+        ret = x509parse_crt( &clicert, (const unsigned char *) test_cli_crt,
                 strlen( test_cli_crt ) );
 #else
     {
@@ -535,7 +536,7 @@ int main( int argc, char *argv[] )
     else
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_key( &rsa, (unsigned char *) test_cli_key,
+        ret = x509parse_key( &rsa, (const unsigned char *) test_cli_key,
                 strlen( test_cli_key ), NULL, 0 );
 #else
     {
@@ -692,7 +693,8 @@ int main( int argc, char *argv[] )
         fflush( stdout );
 
         n = sizeof( buf );
-        len = base64_encode( base, &n, (unsigned char *) opt.user_name, strlen( opt.user_name ) );
+        len = base64_encode( base, &n, (const unsigned char *) opt.user_name,
+                             strlen( opt.user_name ) );
         len = sprintf( (char *) buf, "%s\n", base );
         ret = write_ssl_and_get_response( &ssl, buf, len );
         if( ret < 300 || ret > 399 )
@@ -706,7 +708,8 @@ int main( int argc, char *argv[] )
         printf( "  > Write password to server: %s", opt.user_pwd );
         fflush( stdout );
 
-        len = base64_encode( base, &n, (unsigned char *) opt.user_pwd, strlen( opt.user_pwd ) );
+        len = base64_encode( base, &n, (const unsigned char *) opt.user_pwd,
+                             strlen( opt.user_pwd ) );
         len = sprintf( (char *) buf, "%s\n", base );
         ret = write_ssl_and_get_response( &ssl, buf, len );
         if( ret < 200 || ret > 399 )
diff --git a/programs/ssl/ssl_server.c b/programs/ssl/ssl_server.c
index 5445a7d4d..37846020b 100644
--- a/programs/ssl/ssl_server.c
+++ b/programs/ssl/ssl_server.c
@@ -88,7 +88,7 @@ int main( int argc, char *argv[] )
     int listen_fd;
     int client_fd = -1;
     unsigned char buf[1024];
-    char *pers = "ssl_server";
+    const char *pers = "ssl_server";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -119,7 +119,7 @@ int main( int argc, char *argv[] )
      * Instead, you may want to use x509parse_crtfile() to read the
      * server and CA certificates, as well as x509parse_keyfile().
      */
-    ret = x509parse_crt( &srvcert, (unsigned char *) test_srv_crt,
+    ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt,
                          strlen( test_srv_crt ) );
     if( ret != 0 )
     {
@@ -127,7 +127,7 @@ int main( int argc, char *argv[] )
         goto exit;
     }
 
-    ret = x509parse_crt( &srvcert, (unsigned char *) test_ca_crt,
+    ret = x509parse_crt( &srvcert, (const unsigned char *) test_ca_crt,
                          strlen( test_ca_crt ) );
     if( ret != 0 )
     {
@@ -136,7 +136,7 @@ int main( int argc, char *argv[] )
     }
 
     rsa_init( &rsa, RSA_PKCS_V15, 0 );
-    ret =  x509parse_key( &rsa, (unsigned char *) test_srv_key,
+    ret =  x509parse_key( &rsa, (const unsigned char *) test_srv_key,
                           strlen( test_srv_key ), NULL, 0 );
     if( ret != 0 )
     {
@@ -168,7 +168,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index dd48094ce..f788f5e6a 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -76,12 +76,12 @@ struct options
 {
     int server_port;            /* port on which the ssl service runs       */
     int debug_level;            /* level of debugging                       */
-    char *ca_file;              /* the file with the CA certificate(s)      */
-    char *ca_path;              /* the path with the CA certificate(s) reside */
-    char *crt_file;             /* the file with the client certificate     */
-    char *key_file;             /* the file with the client key             */
-    char *psk;                  /* the pre-shared key                       */
-    char *psk_identity;         /* the pre-shared key identity              */
+    const char *ca_file;        /* the file with the CA certificate(s)      */
+    const char *ca_path;        /* the path with the CA certificate(s) reside */
+    const char *crt_file;       /* the file with the client certificate     */
+    const char *key_file;       /* the file with the client key             */
+    const char *psk;            /* the pre-shared key                       */
+    const char *psk_identity;   /* the pre-shared key identity              */
     int force_ciphersuite[2];   /* protocol/ciphersuite to use, or all      */
     int renegotiation;          /* enable / disable renegotiation           */
     int allow_legacy;           /* allow legacy renegotiation               */
@@ -168,7 +168,7 @@ int main( int argc, char *argv[] )
     unsigned char psk[256];
     size_t psk_len = 0;
 #endif
-    char *pers = "ssl_server2";
+    const char *pers = "ssl_server2";
 
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
@@ -376,7 +376,8 @@ int main( int argc, char *argv[] )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned -0x%x\n", -ret );
         goto exit;
@@ -399,7 +400,7 @@ int main( int argc, char *argv[] )
     else 
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_crt( &cacert, (unsigned char *) test_ca_crt,
+        ret = x509parse_crt( &cacert, (const unsigned char *) test_ca_crt,
                 strlen( test_ca_crt ) );
 #else
     {
@@ -427,7 +428,7 @@ int main( int argc, char *argv[] )
     else 
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_crt( &srvcert, (unsigned char *) test_srv_crt,
+        ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt,
                 strlen( test_srv_crt ) );
 #else
     {
@@ -447,7 +448,7 @@ int main( int argc, char *argv[] )
     else
 #endif
 #if defined(POLARSSL_CERTS_C)
-        ret = x509parse_key( &rsa, (unsigned char *) test_srv_key,
+        ret = x509parse_key( &rsa, (const unsigned char *) test_srv_key,
                 strlen( test_srv_key ), NULL, 0 );
 #else
     {
diff --git a/programs/test/o_p_test.c b/programs/test/o_p_test.c
index eb02350d0..97262825e 100644
--- a/programs/test/o_p_test.c
+++ b/programs/test/o_p_test.c
@@ -75,11 +75,12 @@ int main( int argc, char *argv[] )
     unsigned char o_priv_encrypted[512];
     unsigned char p_priv_decrypted[512];
     unsigned char o_priv_decrypted[512];
-    char *pers = "o_p_test_example";
+    const char *pers = "o_p_test_example";
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                    (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                    (const unsigned char *) pers,
+                    strlen( pers ) ) ) != 0 )
     {
         printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
diff --git a/programs/test/ssl_cert_test.c b/programs/test/ssl_cert_test.c
index 57ea32c8f..83a2a0123 100644
--- a/programs/test/ssl_cert_test.c
+++ b/programs/test/ssl_cert_test.c
@@ -41,7 +41,7 @@
 
 #define MAX_CLIENT_CERTS    8
 
-char *client_certificates[MAX_CLIENT_CERTS] =
+const char *client_certificates[MAX_CLIENT_CERTS] =
 {
     "client1.crt",
     "client2.crt",
@@ -53,7 +53,7 @@ char *client_certificates[MAX_CLIENT_CERTS] =
     "cert_sha512.crt"
 };
 
-char *client_private_keys[MAX_CLIENT_CERTS] =
+const char *client_private_keys[MAX_CLIENT_CERTS] =
 {
     "client1.key",
     "client2.key",
diff --git a/programs/test/ssl_test.c b/programs/test/ssl_test.c
index 5d829e5bc..34fd9c269 100644
--- a/programs/test/ssl_test.c
+++ b/programs/test/ssl_test.c
@@ -74,7 +74,7 @@ struct options
 {
     int opmode;                 /* operation mode (client or server)    */
     int iomode;                 /* I/O mode (blocking or non-blocking)  */
-    char *server_name;          /* hostname of the server (client only) */
+    const char *server_name;    /* hostname of the server (client only) */
     int server_port;            /* port on which the ssl service runs   */
     int command;                /* what to do: read or write operation  */
     int buffer_size;            /* size of the send/receive buffer      */
@@ -153,7 +153,7 @@ static int ssl_test( struct options *opt )
     unsigned char *read_buf = NULL;
     unsigned char *write_buf = NULL;
 
-    char *pers = "ssl_test";
+    const char *pers = "ssl_test";
 
     struct hr_time t;
     entropy_context entropy;
@@ -166,7 +166,8 @@ static int ssl_test( struct options *opt )
 
     entropy_init( &entropy );
     if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                               (const unsigned char *) pers,
+                               strlen( pers ) ) ) != 0 )
     {
         printf( "  ! ctr_drbg_init returned %d\n", ret );
         goto exit;
@@ -204,7 +205,7 @@ static int ssl_test( struct options *opt )
         printf("POLARSSL_CERTS_C not defined.\n");
         goto exit;
 #else
-        ret =  x509parse_crt( &srvcert, (unsigned char *) test_srv_crt,
+        ret =  x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt,
                               strlen( test_srv_crt ) );
         if( ret != 0 )
         {
@@ -212,7 +213,7 @@ static int ssl_test( struct options *opt )
             goto exit;
         }
 
-        ret =  x509parse_crt( &srvcert, (unsigned char *) test_ca_crt,
+        ret =  x509parse_crt( &srvcert, (const unsigned char *) test_ca_crt,
                               strlen( test_ca_crt ) );
         if( ret != 0 )
         {
@@ -220,7 +221,7 @@ static int ssl_test( struct options *opt )
             goto exit;
         }
 
-        ret =  x509parse_key( &rsa, (unsigned char *) test_srv_key,
+        ret =  x509parse_key( &rsa, (const unsigned char *) test_srv_key,
                               strlen( test_srv_key ), NULL, 0 );
         if( ret != 0 )
         {
diff --git a/programs/x509/cert_app.c b/programs/x509/cert_app.c
index 504426a97..2c8a88d7e 100644
--- a/programs/x509/cert_app.c
+++ b/programs/x509/cert_app.c
@@ -58,10 +58,10 @@
 struct options
 {
     int mode;                   /* the mode to run the application in   */
-    char *filename;             /* filename of the certificate file     */
-    char *ca_file;              /* the file with the CA certificate(s)  */
-    char *ca_path;              /* the path with the CA certificate(s) reside */
-    char *server_name;          /* hostname of the server (client only) */
+    const char *filename;       /* filename of the certificate file     */
+    const char *ca_file;        /* the file with the CA certificate(s)  */
+    const char *ca_path;        /* the path with the CA certificate(s) reside */
+    const char *server_name;    /* hostname of the server (client only) */
     int server_port;            /* port on which the ssl service runs   */
     int debug_level;            /* level of debugging                   */
     int permissive;             /* permissive parsing                   */
@@ -161,7 +161,7 @@ int main( int argc, char *argv[] )
     int i, j, n;
     int flags, verify = 0;
     char *p, *q;
-    char *pers = "cert_app";
+    const char *pers = "cert_app";
 
     /*
      * Set to sane values
@@ -357,7 +357,8 @@ int main( int argc, char *argv[] )
 
         entropy_init( &entropy );
         if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                               (unsigned char *) pers, strlen( pers ) ) ) != 0 )
+                                   (const unsigned char *) pers,
+                                   strlen( pers ) ) ) != 0 )
         {
             printf( " failed\n  ! ctr_drbg_init returned %d\n", ret );
             goto exit;
diff --git a/programs/x509/crl_app.c b/programs/x509/crl_app.c
index 38ac3c6ff..fb191a1b4 100644
--- a/programs/x509/crl_app.c
+++ b/programs/x509/crl_app.c
@@ -43,7 +43,7 @@
  */
 struct options
 {
-    char *filename;             /* filename of the certificate file     */
+    const char *filename;       /* filename of the certificate file     */
     int debug_level;            /* level of debugging                   */
 } opt;
 
diff --git a/tests/suites/test_suite_rsa.function b/tests/suites/test_suite_rsa.function
index 398b3b34e..72c296744 100644
--- a/tests/suites/test_suite_rsa.function
+++ b/tests/suites/test_suite_rsa.function
@@ -468,11 +468,11 @@ rsa_gen_key:nrbits:exponent:result
     rsa_context ctx;
     entropy_context entropy;
     ctr_drbg_context ctr_drbg;
-    char *pers = "test_suite_rsa";
+    const char *pers = "test_suite_rsa";
 
     entropy_init( &entropy );
     TEST_ASSERT( ctr_drbg_init( &ctr_drbg, entropy_func, &entropy,
-                                (unsigned char *) pers, strlen( pers ) ) == 0 );
+                                (const unsigned char *) pers, strlen( pers ) ) == 0 );
 
     rsa_init( &ctx, 0, 0 );