--- libressl-2.7.4.orig/tls/tls_verify.c
+++ libressl-2.7.4/tls/tls_verify.c
@@ -126,12 +126,12 @@
 			continue;
 
 		if (type == GEN_DNS) {
-			unsigned char	*data;
+			const unsigned char	*data;
 			int		 format, len;
 
 			format = ASN1_STRING_type(altname->d.dNSName);
 			if (format == V_ASN1_IA5STRING) {
-				data = ASN1_STRING_data(altname->d.dNSName);
+				data = ASN1_STRING_get0_data(altname->d.dNSName);
 				len = ASN1_STRING_length(altname->d.dNSName);
 
 				if (len < 0 || (size_t)len != strlen(data)) {
@@ -171,11 +171,11 @@
 			}
 
 		} else if (type == GEN_IPADD) {
-			unsigned char	*data;
+			const unsigned char	*data;
 			int		 datalen;
 
 			datalen = ASN1_STRING_length(altname->d.iPAddress);
-			data = ASN1_STRING_data(altname->d.iPAddress);
+			data = ASN1_STRING_get0_data(altname->d.iPAddress);
 
 			if (datalen < 0) {
 				tls_set_errorx(ctx,