diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 7eb18ad2020a32..aa2dafebc5cf81 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -120,13 +120,13 @@ static X509_NAME *cnnic_ev_name =
 
 static Mutex* mutexes;
 
-const char* const root_certs[] = {
+static const char* const root_certs[] = {
 #include "node_root_certs.h"  // NOLINT(build/include_order)
 };
 
-std::string extra_root_certs_file;  // NOLINT(runtime/string)
+static std::string extra_root_certs_file;  // NOLINT(runtime/string)
 
-X509_STORE* root_cert_store;
+static X509_STORE* root_cert_store;
 
 // Just to generate static methods
 template class SSLWrap<TLSWrap>;
diff --git a/src/node_crypto.h b/src/node_crypto.h
index 38f49ba5a05063..746c954b26fb43 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -63,8 +63,6 @@ enum CheckResult {
 
 extern int VerifyCallback(int preverify_ok, X509_STORE_CTX* ctx);
 
-extern X509_STORE* root_cert_store;
-
 extern void UseExtraCaCerts(const std::string& file);
 
 // Forward declaration