diff --git a/src/lib/net/SecureSocket.cpp b/src/lib/net/SecureSocket.cpp
index f6ed0194..3d5e2be0 100644
--- a/src/lib/net/SecureSocket.cpp
+++ b/src/lib/net/SecureSocket.cpp
@@ -675,7 +675,7 @@ SecureSocket::verifyCertFingerprint()
 
     // format fingerprint into hexdecimal format with colon separator
     std::string fingerprint(reinterpret_cast<char*>(tempFingerprint), tempFingerprintLen);
-    format_ssl_fingerprint(fingerprint);
+    fingerprint = format_ssl_fingerprint(fingerprint);
     LOG((CLOG_NOTE "server fingerprint: %s", fingerprint.c_str()));
 
     std::string trustedServersFilename;
diff --git a/src/lib/net/SecureUtils.cpp b/src/lib/net/SecureUtils.cpp
index c796e9c7..72d4fbf0 100644
--- a/src/lib/net/SecureUtils.cpp
+++ b/src/lib/net/SecureUtils.cpp
@@ -18,21 +18,22 @@
 #include "SecureUtils.h"
 #include "base/String.h"
 
-void format_ssl_fingerprint(std::string& fingerprint, bool hex, bool separator)
+std::string format_ssl_fingerprint(const std::string& fingerprint, bool hex, bool separator)
 {
+    std::string result = fingerprint;
     if (hex) {
         // to hexadecimal
-        barrier::string::toHex(fingerprint, 2);
+        barrier::string::toHex(result, 2);
     }
 
     // all uppercase
-    barrier::string::uppercase(fingerprint);
+    barrier::string::uppercase(result);
 
     if (separator) {
         // add colon to separate each 2 characters
-        size_t separators = fingerprint.size() / 2;
+        size_t separators = result.size() / 2;
         for (size_t i = 1; i < separators; i++) {
-            fingerprint.insert(i * 3 - 1, ":");
+            result.insert(i * 3 - 1, ":");
         }
     }
 }
diff --git a/src/lib/net/SecureUtils.h b/src/lib/net/SecureUtils.h
index 7b6d09bc..7c94fe92 100644
--- a/src/lib/net/SecureUtils.h
+++ b/src/lib/net/SecureUtils.h
@@ -20,6 +20,7 @@
 
 #include <string>
 
-void format_ssl_fingerprint(std::string& fingerprint, bool hex = true, bool separator = true);
+std::string format_ssl_fingerprint(const std::string& fingerprint,
+                                   bool hex = true, bool separator = true);
 
 #endif // BARRIER_LIB_NET_SECUREUTILS_H