diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 84cf039f2..8f955e6bc 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -1667,7 +1667,8 @@ cleanup:
     return( ret );
 }
 
-char *ssl_get_kex_mode_str(int mode)
+#if defined(MBEDTLS_DEBUG_C)
+static const char *ssl_tls13_get_kex_mode_str(int mode)
 {
     switch( mode )
     {
@@ -1681,6 +1682,7 @@ char *ssl_get_kex_mode_str(int mode)
             return "unknown mode";
     }
 }
+#endif /* MBEDTLS_DEBUG_C */
 
 MBEDTLS_CHECK_RETURN_CRITICAL
 static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
@@ -1726,13 +1728,13 @@ static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
         ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
         MBEDTLS_SSL_DEBUG_MSG( 2,
                 ( "Key exchange mode(%s) is not configured supported.",
-                ssl_get_kex_mode_str( handshake->key_exchange_mode ) ) );
+                ssl_tls13_get_kex_mode_str( handshake->key_exchange_mode ) ) );
         goto cleanup;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
             ( "Server selected key exchange mode: %s",
-              ssl_get_kex_mode_str( handshake->key_exchange_mode ) ) );
+              ssl_tls13_get_kex_mode_str( handshake->key_exchange_mode ) ) );
 
     /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
      *