diff --git a/mongoose.c b/mongoose.c
index 2a71d65c..a41c8016 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -13319,17 +13319,17 @@ static void mg_tls_mgf1(uint8_t *mask, size_t mask_len, const uint8_t *seed,
   }
 }
 
-static unsigned mg_tls_rsa_bits(const struct mg_str *n) {
+static unsigned int mg_tls_rsa_bits(const struct mg_str *n) {
   size_t i = 0;
-  unsigned bits = 0;
+  unsigned int bits = 0;
   while (i < n->len && n->buf[i] == 0) i++;
   if (i == n->len) return 0;
-  bits = (unsigned) ((n->len - i) * 8);
+  bits = (unsigned int) ((n->len - i) * 8);
   {
     uint8_t byte = (uint8_t) n->buf[i];
     while ((byte & 0x80U) == 0) {
       bits--;
-      byte <<= 1;
+      byte = (uint8_t) (byte << 1);
     }
   }
   return bits;
@@ -13492,9 +13492,9 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
 
     // Build verify packet header, then sign directly into the packet
     verify[0] = 0x0f;
-    MG_STORE_BE24(verify + 1, (uint32_t) (emlen + 4));
+    MG_STORE_BE24(verify + 1, emlen + 4);
     MG_STORE_BE16(verify + 4, 0x0804);
-    MG_STORE_BE16(verify + 6, (uint16_t) emlen);
+    MG_STORE_BE16(verify + 6, emlen);
 
     // Sign directly into the verify buffer (verify + 8 = signature location)
     memset(verify + 8, 0, emlen);  // Initialize signature area
@@ -14447,7 +14447,7 @@ static int mg_rsa_parse_der_int(const uint8_t **p, const uint8_t *end,
   *p = value_end;
 
   MG_VERBOSE(("DER INT: parsed %u bytes (skipped zero=%d)", len,
-              value_end - value_start != len ? 1 : 0));
+              (size_t)(value_end - value_start) != (size_t) len ? 1 : 0));
   return 0;
 }
 
@@ -14499,7 +14499,7 @@ static int mg_parse_ec_private_key(const uint8_t *der, size_t dersz,
 //   exponent2         INTEGER,  -- dQ = d mod (q-1)
 //   coefficient       INTEGER,  -- qInv = (inverse of q) mod p
 // }
-int mg_rsa_parse_key(const uint8_t *der, size_t dersz, struct mg_rsa_key *key) {
+static int mg_rsa_parse_key(const uint8_t *der, size_t dersz, struct mg_rsa_key *key) {
   const uint8_t *p = der;
   const uint8_t *end = der + dersz;
   uint32_t seq_len;
@@ -18586,12 +18586,12 @@ int mg_rsa_crt_sign(const uint8_t *em, size_t em_len,
     return -1;
   }
 
-  em_bi = bi_import(ctx, em, em_len);
-  dP_bi = bi_import(ctx, dP, dP_len);
-  dQ_bi = bi_import(ctx, dQ, dQ_len);
-  p_bi = bi_import(ctx, p, p_len);
-  q_bi = bi_import(ctx, q, q_len);
-  qInv_bi = bi_import(ctx, qInv, qInv_len);
+  em_bi = bi_import(ctx, em, (int) em_len);
+  dP_bi = bi_import(ctx, dP, (int) dP_len);
+  dQ_bi = bi_import(ctx, dQ, (int) dQ_len);
+  p_bi = bi_import(ctx, p, (int) p_len);
+  q_bi = bi_import(ctx, q, (int) q_len);
+  qInv_bi = bi_import(ctx, qInv, (int) qInv_len);
 
   if (em_bi == NULL || dP_bi == NULL || dQ_bi == NULL ||
       p_bi == NULL || q_bi == NULL || qInv_bi == NULL) {
@@ -18605,7 +18605,7 @@ int mg_rsa_crt_sign(const uint8_t *em, size_t em_len,
   if (result_bi == NULL) {
     goto cleanup;
   }
-  bi_export(ctx, result_bi, signature, sig_len);
+  bi_export(ctx, result_bi, signature, (int) sig_len);
   ret = 0;  // Success!
 cleanup:
   bi_free_mod(ctx, BIGINT_P_OFFSET);  // cloned p_bi stored in mod context
diff --git a/src/tls_builtin.c b/src/tls_builtin.c
index 22067e51..38209c2a 100644
--- a/src/tls_builtin.c
+++ b/src/tls_builtin.c
@@ -857,17 +857,17 @@ static void mg_tls_mgf1(uint8_t *mask, size_t mask_len, const uint8_t *seed,
   }
 }
 
-static unsigned mg_tls_rsa_bits(const struct mg_str *n) {
+static unsigned int mg_tls_rsa_bits(const struct mg_str *n) {
   size_t i = 0;
-  unsigned bits = 0;
+  unsigned int bits = 0;
   while (i < n->len && n->buf[i] == 0) i++;
   if (i == n->len) return 0;
-  bits = (unsigned) ((n->len - i) * 8);
+  bits = (unsigned int) ((n->len - i) * 8);
   {
     uint8_t byte = (uint8_t) n->buf[i];
     while ((byte & 0x80U) == 0) {
       bits--;
-      byte <<= 1;
+      byte = (uint8_t) (byte << 1);
     }
   }
   return bits;
@@ -1030,9 +1030,9 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
 
     // Build verify packet header, then sign directly into the packet
     verify[0] = 0x0f;
-    MG_STORE_BE24(verify + 1, (uint32_t) (emlen + 4));
+    MG_STORE_BE24(verify + 1, emlen + 4);
     MG_STORE_BE16(verify + 4, 0x0804);
-    MG_STORE_BE16(verify + 6, (uint16_t) emlen);
+    MG_STORE_BE16(verify + 6, emlen);
 
     // Sign directly into the verify buffer (verify + 8 = signature location)
     memset(verify + 8, 0, emlen);  // Initialize signature area
@@ -1985,7 +1985,7 @@ static int mg_rsa_parse_der_int(const uint8_t **p, const uint8_t *end,
   *p = value_end;
 
   MG_VERBOSE(("DER INT: parsed %u bytes (skipped zero=%d)", len,
-              value_end - value_start != len ? 1 : 0));
+              (size_t)(value_end - value_start) != (size_t) len ? 1 : 0));
   return 0;
 }
 
@@ -2037,7 +2037,7 @@ static int mg_parse_ec_private_key(const uint8_t *der, size_t dersz,
 //   exponent2         INTEGER,  -- dQ = d mod (q-1)
 //   coefficient       INTEGER,  -- qInv = (inverse of q) mod p
 // }
-int mg_rsa_parse_key(const uint8_t *der, size_t dersz, struct mg_rsa_key *key) {
+static int mg_rsa_parse_key(const uint8_t *der, size_t dersz, struct mg_rsa_key *key) {
   const uint8_t *p = der;
   const uint8_t *end = der + dersz;
   uint32_t seq_len;
diff --git a/src/tls_rsa.c b/src/tls_rsa.c
index 8bc0d88a..a741d7af 100644
--- a/src/tls_rsa.c
+++ b/src/tls_rsa.c
@@ -1603,12 +1603,12 @@ int mg_rsa_crt_sign(const uint8_t *em, size_t em_len,
     return -1;
   }
 
-  em_bi = bi_import(ctx, em, em_len);
-  dP_bi = bi_import(ctx, dP, dP_len);
-  dQ_bi = bi_import(ctx, dQ, dQ_len);
-  p_bi = bi_import(ctx, p, p_len);
-  q_bi = bi_import(ctx, q, q_len);
-  qInv_bi = bi_import(ctx, qInv, qInv_len);
+  em_bi = bi_import(ctx, em, (int) em_len);
+  dP_bi = bi_import(ctx, dP, (int) dP_len);
+  dQ_bi = bi_import(ctx, dQ, (int) dQ_len);
+  p_bi = bi_import(ctx, p, (int) p_len);
+  q_bi = bi_import(ctx, q, (int) q_len);
+  qInv_bi = bi_import(ctx, qInv, (int) qInv_len);
 
   if (em_bi == NULL || dP_bi == NULL || dQ_bi == NULL ||
       p_bi == NULL || q_bi == NULL || qInv_bi == NULL) {
@@ -1622,7 +1622,7 @@ int mg_rsa_crt_sign(const uint8_t *em, size_t em_len,
   if (result_bi == NULL) {
     goto cleanup;
   }
-  bi_export(ctx, result_bi, signature, sig_len);
+  bi_export(ctx, result_bi, signature, (int) sig_len);
   ret = 0;  // Success!
 cleanup:
   bi_free_mod(ctx, BIGINT_P_OFFSET);  // cloned p_bi stored in mod context