diff --git a/ssl/internal.h b/ssl/internal.h
index f940eda..19f6bc1 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -1706,13 +1706,6 @@
 const struct ssl_cipher_preference_list_st *ssl_get_cipher_preferences(
     const SSL *ssl);
 
-int ssl_cert_set0_chain(CERT *cert, STACK_OF(X509) *chain);
-int ssl_cert_set1_chain(CERT *cert, STACK_OF(X509) *chain);
-int ssl_cert_add0_chain_cert(CERT *cert, X509 *x509);
-int ssl_cert_add1_chain_cert(CERT *cert, X509 *x509);
-void ssl_cert_set_cert_cb(CERT *cert,
-                          int (*cb)(SSL *ssl, void *arg), void *arg);
-
 int ssl_verify_cert_chain(SSL *ssl, long *out_verify_result,
                           STACK_OF(X509) * cert_chain);
 void ssl_update_cache(SSL_HANDSHAKE *hs, int mode);
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 7f6cf63..c0bdb5c 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -244,13 +244,13 @@
   OPENSSL_free(c);
 }
 
-int ssl_cert_set0_chain(CERT *cert, STACK_OF(X509) *chain) {
+static int ssl_cert_set0_chain(CERT *cert, STACK_OF(X509) *chain) {
   sk_X509_pop_free(cert->x509_chain, X509_free);
   cert->x509_chain = chain;
   return 1;
 }
 
-int ssl_cert_set1_chain(CERT *cert, STACK_OF(X509) *chain) {
+static int ssl_cert_set1_chain(CERT *cert, STACK_OF(X509) *chain) {
   STACK_OF(X509) *dchain;
   if (chain == NULL) {
     return ssl_cert_set0_chain(cert, NULL);
@@ -269,7 +269,7 @@
   return 1;
 }
 
-int ssl_cert_add0_chain_cert(CERT *cert, X509 *x509) {
+static int ssl_cert_add0_chain_cert(CERT *cert, X509 *x509) {
   if (cert->x509_chain == NULL) {
     cert->x509_chain = sk_X509_new_null();
   }
@@ -280,7 +280,7 @@
   return 1;
 }
 
-int ssl_cert_add1_chain_cert(CERT *cert, X509 *x509) {
+static int ssl_cert_add1_chain_cert(CERT *cert, X509 *x509) {
   if (!ssl_cert_add0_chain_cert(cert, x509)) {
     return 0;
   }
@@ -289,7 +289,8 @@
   return 1;
 }
 
-void ssl_cert_set_cert_cb(CERT *c, int (*cb)(SSL *ssl, void *arg), void *arg) {
+static void ssl_cert_set_cert_cb(CERT *c, int (*cb)(SSL *ssl, void *arg),
+                                 void *arg) {
   c->cert_cb = cb;
   c->cert_cb_arg = arg;
 }
@@ -775,6 +776,15 @@
   return SSL_set0_chain(ssl, NULL);
 }
 
+void SSL_CTX_set_cert_cb(SSL_CTX *ctx, int (*cb)(SSL *ssl, void *arg),
+                         void *arg) {
+  ssl_cert_set_cert_cb(ctx->cert, cb, arg);
+}
+
+void SSL_set_cert_cb(SSL *ssl, int (*cb)(SSL *ssl, void *arg), void *arg) {
+  ssl_cert_set_cert_cb(ssl->cert, cb, arg);
+}
+
 int SSL_CTX_get0_chain_certs(const SSL_CTX *ctx, STACK_OF(X509) **out_chain) {
   *out_chain = ctx->cert->x509_chain;
   return 1;
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 364c598..d504240 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -2016,15 +2016,6 @@
   X509_VERIFY_PARAM_set_depth(ctx->param, depth);
 }
 
-void SSL_CTX_set_cert_cb(SSL_CTX *ctx, int (*cb)(SSL *ssl, void *arg),
-                         void *arg) {
-  ssl_cert_set_cert_cb(ctx->cert, cb, arg);
-}
-
-void SSL_set_cert_cb(SSL *ssl, int (*cb)(SSL *ssl, void *arg), void *arg) {
-  ssl_cert_set_cert_cb(ssl->cert, cb, arg);
-}
-
 size_t SSL_get0_certificate_types(SSL *ssl, const uint8_t **out_types) {
   if (ssl->server || ssl->s3->hs == NULL) {
     *out_types = NULL;