diff --git a/kdc/kx509.c b/kdc/kx509.c
index a13c08325..6217f5c55 100644
--- a/kdc/kx509.c
+++ b/kdc/kx509.c
@@ -542,7 +542,7 @@ update_csr(krb5_context context, kx509_req_context reqctx, Extensions *exts)
         }
     }
     if (ret) {
-	char *emsg = krb5_get_error_message(context, ret);
+	const char *emsg = krb5_get_error_message(context, ret);
         kdc_log(context, reqctx->config, 1,
                 "Error handling requested extensions: %s", emsg);
         _kdc_audit_addreason((kdc_request_t)reqctx,