diff --git a/library/x509.c b/library/x509.c
index 38eb2e6..d61ef4a 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -53,13 +53,17 @@
 #include <time.h>
 #endif
 
-#define CHECK(code) if ((ret = (code)) != 0) { return ret; }
+#define CHECK(code)                                     \
+    do {                                                \
+        if ((ret = (code)) != 0) {                      \
+            return ret;                                 \
+        }                                               \
+    } while (0)
+
 #define CHECK_RANGE(min, max, val)                      \
-    do                                                  \
-    {                                                   \
-        if ((val) < (min) || (val) > (max))    \
-        {                                               \
-            return ret;                              \
+    do {                                                \
+        if ((val) < (min) || (val) > (max)) {           \
+            return ret;                                 \
         }                                               \
     } while (0)
 
diff --git a/library/x509_crt.c b/library/x509_crt.c
index e7fcaf4..5b51694 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -1944,16 +1944,19 @@
     return 0;
 }
 
-#define PRINT_ITEM(i)                           \
-    {                                           \
-        ret = mbedtls_snprintf(p, n, "%s" i, sep);    \
-        MBEDTLS_X509_SAFE_SNPRINTF;                        \
-        sep = ", ";                             \
-    }
+#define PRINT_ITEM(i)                              \
+    do {                                           \
+        ret = mbedtls_snprintf(p, n, "%s" i, sep); \
+        MBEDTLS_X509_SAFE_SNPRINTF;                \
+        sep = ", ";                                \
+    } while (0)
 
-#define CERT_TYPE(type, name)                    \
-    if (ns_cert_type & (type))                 \
-    PRINT_ITEM(name);
+#define CERT_TYPE(type, name)                      \
+    do {                                           \
+        if (ns_cert_type & (type)) {               \
+            PRINT_ITEM(name);                      \
+        }                                          \
+    } while (0)
 
 static int x509_info_cert_type(char **buf, size_t *size,
                                unsigned char ns_cert_type)
@@ -1978,9 +1981,12 @@
     return 0;
 }
 
-#define KEY_USAGE(code, name)    \
-    if (key_usage & (code))    \
-    PRINT_ITEM(name);
+#define KEY_USAGE(code, name)                      \
+    do {                                           \
+        if (key_usage & (code)) {                  \
+            PRINT_ITEM(name);                      \
+        }                                          \
+    } while (0)
 
 static int x509_info_key_usage(char **buf, size_t *size,
                                unsigned int key_usage)