diff --git a/include/mbedtls/debug.h b/include/mbedtls/debug.h
index fcf149083..8a4da1c0e 100644
--- a/include/mbedtls/debug.h
+++ b/include/mbedtls/debug.h
@@ -124,7 +124,7 @@ void debug_print_ret( const ssl_context *ssl, int level,
 
 void debug_print_buf( const ssl_context *ssl, int level,
                       const char *file, int line, const char *text,
-                      unsigned char *buf, size_t len );
+                      const unsigned char *buf, size_t len );
 
 #if defined(POLARSSL_BIGNUM_C)
 void debug_print_mpi( const ssl_context *ssl, int level,
diff --git a/library/debug.c b/library/debug.c
index bb497b85c..ade98d486 100644
--- a/library/debug.c
+++ b/library/debug.c
@@ -120,7 +120,7 @@ void debug_print_ret( const ssl_context *ssl, int level,
 
 void debug_print_buf( const ssl_context *ssl, int level,
                       const char *file, int line, const char *text,
-                      unsigned char *buf, size_t len )
+                      const unsigned char *buf, size_t len )
 {
     char str[512];
     char txt[17];
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 09d5cf84b..2b94af87e 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -1118,7 +1118,7 @@ static int ssl_parse_hello_verify_request( ssl_context *ssl )
      *   opaque cookie<0..2^8-1>;
      * } HelloVerifyRequest;
      */
-    SSL_DEBUG_BUF( 3, "server version", (unsigned char *) p, 2 );
+    SSL_DEBUG_BUF( 3, "server version", p, 2 );
     ssl_read_version( &major_ver, &minor_ver, ssl->transport, p );
     p += 2;
 
@@ -1140,7 +1140,7 @@ static int ssl_parse_hello_verify_request( ssl_context *ssl )
     }
 
     cookie_len = *p++;
-    SSL_DEBUG_BUF( 3, "cookie", (unsigned char *) p, cookie_len );
+    SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
 
     polarssl_free( ssl->handshake->verify_cookie );
 
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 908c56d09..ff2c44bf7 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -2342,7 +2342,7 @@ static int ssl_write_hello_verify_request( ssl_context *ssl )
      * version looks like the most interoperable thing to do. */
     ssl_write_version( ssl->major_ver, ssl->minor_ver,
                        ssl->transport, p );
-    SSL_DEBUG_BUF( 3, "server version", (unsigned char *) p, 2 );
+    SSL_DEBUG_BUF( 3, "server version", p, 2 );
     p += 2;
 
     /* If we get here, f_cookie_check is not null */