diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c
index 63cef40e4089de9cf4882410f9bf7e2980474f4f..191a8b051f02874403c7db1e2bc6498ee7242d0e 100644
--- a/crypto/x509/x509_cmp.c
+++ b/crypto/x509/x509_cmp.c
@@ -257,7 +257,7 @@ X509 *X509_find_by_subject(STACK_OF(X509) *sk, X509_NAME *name)
     return (NULL);
 }
 
-EVP_PKEY *X509_get0_pubkey(X509 *x)
+EVP_PKEY *X509_get0_pubkey(const X509 *x)
 {
     if (x == NULL)
         return NULL;
@@ -271,9 +271,9 @@ EVP_PKEY *X509_get_pubkey(X509 *x)
     return X509_PUBKEY_get(x->cert_info.key);
 }
 
-int X509_check_private_key(X509 *x, EVP_PKEY *k)
+int X509_check_private_key(const X509 *x, const EVP_PKEY *k)
 {
-    EVP_PKEY *xk;
+    const EVP_PKEY *xk;
     int ret;
 
     xk = X509_get0_pubkey(x);
diff --git a/crypto/x509/x509cset.c b/crypto/x509/x509cset.c
index 43ff668b719fb193d52ec9c8157a707438d4b24d..3763492510b80bcb7faeee1d37bcc3a230d45b38 100644
--- a/crypto/x509/x509cset.c
+++ b/crypto/x509/x509cset.c
@@ -178,7 +178,7 @@ int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial)
     return 1;
 }
 
-STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions(X509_REVOKED *r)
+STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions(const X509_REVOKED *r)
 {
     return r->extensions;
 }
diff --git a/doc/crypto/X509V3_get_d2i.pod b/doc/crypto/X509V3_get_d2i.pod
index 5a5415cf70b5189dcacdb37b1c33cdccadcc43e3..126393e408cc75768a4ec3f65282eaa6a4efdd43 100644
--- a/doc/crypto/X509V3_get_d2i.pod
+++ b/doc/crypto/X509V3_get_d2i.pod
@@ -34,7 +34,7 @@ X509_REVOKED_add1_ext_i2d - X509 extension decode and encode functions
 
  STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x);
  STACK_OF(X509_EXTENSION) *X509_CRL_get0_extensions(X509_CRL *crl);
- STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions(X509_REVOKED *r);
+ STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions(const X509_REVOKED *r);
 
 =head1 DESCRIPTION
 
diff --git a/doc/crypto/X509_get_pubkey.pod b/doc/crypto/X509_get_pubkey.pod
index 2a5718fd2979214dd68344e496b07cd0d6bddd6b..2b9a956c2d04a1e4f05768250a5924983e8a3da2 100644
--- a/doc/crypto/X509_get_pubkey.pod
+++ b/doc/crypto/X509_get_pubkey.pod
@@ -12,7 +12,7 @@ public key
  #include <openssl/x509.h>
 
  EVP_PKEY *X509_get_pubkey(X509 *x);
- EVP_PKEY *X509_get0_pubkey(X509 *x);
+ EVP_PKEY *X509_get0_pubkey(const X509 *x);
  int X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
  X509_PUBKEY *X509_get_X509_PUBKEY(X509 *x);
 
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 11af4f1921af75168f413350132beb318a1b1695..2447c3583c481b9de3be4d60191a9172b316ad97 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -633,7 +633,7 @@ STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x);
 void X509_get0_uids(ASN1_BIT_STRING **piuid, ASN1_BIT_STRING **psuid, X509 *x);
 X509_ALGOR *X509_get0_tbs_sigalg(X509 *x);
 
-EVP_PKEY *X509_get0_pubkey(X509 *x);
+EVP_PKEY *X509_get0_pubkey(const X509 *x);
 EVP_PKEY *X509_get_pubkey(X509 *x);
 ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x);
 int X509_certificate_type(X509 *x, EVP_PKEY *pubkey /* optional */ );
@@ -696,14 +696,14 @@ ASN1_INTEGER *X509_REVOKED_get0_serialNumber(X509_REVOKED *x);
 int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial);
 ASN1_TIME *X509_REVOKED_get0_revocationDate(X509_REVOKED *x);
 int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm);
-STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions(X509_REVOKED *r);
+STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions(const X509_REVOKED *r);
 
 X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer,
                         EVP_PKEY *skey, const EVP_MD *md, unsigned int flags);
 
 int X509_REQ_check_private_key(X509_REQ *x509, EVP_PKEY *pkey);
 
-int X509_check_private_key(X509 *x509, EVP_PKEY *pkey);
+int X509_check_private_key(const X509 *x509, const EVP_PKEY *pkey);
 int X509_chain_check_suiteb(int *perror_depth,
                             X509 *x, STACK_OF(X509) *chain,
                             unsigned long flags);