diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h
index f3ef572..bea1654 100644
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -32,7 +32,6 @@
 
 #include "x509.h"
 #include "x509_crl.h"
-#include "x509_internal.h"
 
 /**
  * \addtogroup x509_module
@@ -48,6 +47,22 @@
  * \{
  */
 
+typedef struct mbedtls_x509_crt_cache
+{
+#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) || \
+    defined(MBEDTLS_THREADING_C)
+    uint32_t frame_readers;
+    uint32_t pk_readers;
+#endif /* !MBEDTLS_X509_ALWAYS_FLUSH || MBEDTLS_THREADING_C */
+#if defined(MBEDTLS_THREADING_C)
+    mbedtls_threading_mutex_t frame_mutex;
+    mbedtls_threading_mutex_t pk_mutex;
+#endif
+    mbedtls_x509_buf_raw pk_raw;
+    struct mbedtls_x509_crt_frame *frame;
+    struct mbedtls_pk_context *pk;
+} mbedtls_x509_crt_cache;
+
 typedef struct mbedtls_x509_crt_frame
 {
     /* Keep these 8-bit fields at the front of the structure to allow them to
@@ -854,37 +869,8 @@
  *               to hold the address of a frame for the given CRT.
  * \return       A negative error code on failure.
  */
-static inline int mbedtls_x509_crt_frame_acquire( mbedtls_x509_crt const *crt,
-                                          mbedtls_x509_crt_frame const **dst )
-{
-    int ret = 0;
-#if defined(MBEDTLS_THREADING_C)
-    if( mbedtls_mutex_lock( &crt->cache->frame_mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-#endif /* MBEDTLS_THREADING_C */
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) ||      \
-    defined(MBEDTLS_THREADING_C)
-    if( crt->cache->frame_readers == 0 )
-#endif
-        ret = mbedtls_x509_crt_cache_provide_frame( crt );
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) ||      \
-    defined(MBEDTLS_THREADING_C)
-    if( crt->cache->frame_readers == MBEDTLS_X509_CACHE_FRAME_READERS_MAX )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-
-    crt->cache->frame_readers++;
-#endif
-
-#if defined(MBEDTLS_THREADING_C)
-    if( mbedtls_mutex_unlock( &crt->cache->frame_mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-#endif /* MBEDTLS_THREADING_C */
-
-    *dst = crt->cache->frame;
-    return( ret );
-}
+int mbedtls_x509_crt_frame_acquire( mbedtls_x509_crt const *crt,
+                                          mbedtls_x509_crt_frame const **dst );
 
 /**
  * \brief        Release access to a certificate frame acquired
@@ -893,36 +879,7 @@
  * \param crt    The certificate for which a certificate frame has
  *               previously been acquired.
  */
-static inline int mbedtls_x509_crt_frame_release( mbedtls_x509_crt const *crt )
-{
-#if defined(MBEDTLS_THREADING_C)
-    if( mbedtls_mutex_lock( &crt->cache->frame_mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-#endif /* MBEDTLS_THREADING_C */
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) ||      \
-    defined(MBEDTLS_THREADING_C)
-    if( crt->cache->frame_readers == 0 )
-        return( MBEDTLS_ERR_X509_FATAL_ERROR );
-
-    crt->cache->frame_readers--;
-#endif
-
-#if defined(MBEDTLS_THREADING_C)
-    mbedtls_mutex_unlock( &crt->cache->frame_mutex );
-#endif /* MBEDTLS_THREADING_C */
-
-#if defined(MBEDTLS_X509_ALWAYS_FLUSH)
-    (void) mbedtls_x509_crt_flush_cache_frame( crt );
-#endif /* MBEDTLS_X509_ALWAYS_FLUSH */
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) && \
-    !defined(MBEDTLS_THREADING_C)
-    ((void) crt);
-#endif
-
-    return( 0 );
-}
+int mbedtls_x509_crt_frame_release( mbedtls_x509_crt const *crt );
 
 /**
  * \brief        Request temporary access to a public key context
@@ -956,37 +913,8 @@
  *               certificate.
  * \return       A negative error code on failure.
  */
-static inline int mbedtls_x509_crt_pk_acquire( mbedtls_x509_crt const *crt,
-                                               mbedtls_pk_context **dst )
-{
-    int ret = 0;
-#if defined(MBEDTLS_THREADING_C)
-    if( mbedtls_mutex_lock( &crt->cache->pk_mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-#endif /* MBEDTLS_THREADING_C */
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) ||      \
-    defined(MBEDTLS_THREADING_C)
-    if( crt->cache->pk_readers == 0 )
-#endif
-        ret = mbedtls_x509_crt_cache_provide_pk( crt );
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) ||      \
-    defined(MBEDTLS_THREADING_C)
-    if( crt->cache->pk_readers == MBEDTLS_X509_CACHE_PK_READERS_MAX )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-
-    crt->cache->pk_readers++;
-#endif
-
-#if defined(MBEDTLS_THREADING_C)
-    if( mbedtls_mutex_unlock( &crt->cache->pk_mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-#endif /* MBEDTLS_THREADING_C */
-
-    *dst = crt->cache->pk;
-    return( ret );
-}
+int mbedtls_x509_crt_pk_acquire( mbedtls_x509_crt const *crt,
+                                               mbedtls_pk_context **dst );
 
 /**
  * \brief        Release access to a public key context acquired
@@ -995,36 +923,7 @@
  * \param crt    The certificate for which a certificate frame has
  *               previously been acquired.
  */
-static inline int mbedtls_x509_crt_pk_release( mbedtls_x509_crt const *crt )
-{
-#if defined(MBEDTLS_THREADING_C)
-    if( mbedtls_mutex_lock( &crt->cache->pk_mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
-#endif /* MBEDTLS_THREADING_C */
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) ||      \
-    defined(MBEDTLS_THREADING_C)
-    if( crt->cache->pk_readers == 0 )
-        return( MBEDTLS_ERR_X509_FATAL_ERROR );
-
-    crt->cache->pk_readers--;
-#endif
-
-#if defined(MBEDTLS_THREADING_C)
-    mbedtls_mutex_unlock( &crt->cache->pk_mutex );
-#endif /* MBEDTLS_THREADING_C */
-
-#if defined(MBEDTLS_X509_ALWAYS_FLUSH)
-    (void) mbedtls_x509_crt_flush_cache_pk( crt );
-#endif /* MBEDTLS_X509_ALWAYS_FLUSH */
-
-#if !defined(MBEDTLS_X509_ALWAYS_FLUSH) && \
-    !defined(MBEDTLS_THREADING_C)
-    ((void) crt);
-#endif
-
-    return( 0 );
-}
+int mbedtls_x509_crt_pk_release( mbedtls_x509_crt const *crt );
 
 #endif /* MBEDTLS_X509_CRT_PARSE_C */