diff --git a/.sai.json b/.sai.json
index ac00c3aca..127c1c0f3 100644
--- a/.sai.json
+++ b/.sai.json
@@ -29,6 +29,9 @@
 		"linux-gentoo/x86_64-amd/gcc": {
 			"build": "mkdir build destdir;cd build;export CCACHE_DISABLE=1;export SAI_CPACK=\"-G ZIP\";cmake .. ${cmake} && make -j4 && make -j DESTDIR=../destdir install && ctest -j4 --output-on-failure ${cpack}"
 		},
+		"linux-centos-7/x86_64-amd/gcc": {
+			"build": "mkdir build destdir;cd build;export CCACHE_DISABLE=1;export SAI_CPACK=\"-G RPM\";cmake .. ${cmake} && make -j4 && make -j DESTDIR=../destdir install && ctest -j4 --output-on-failure ${cpack}"
+		},
 		"linux-centos-8/x86_64-amd/gcc": {
 			"build": "mkdir build destdir;cd build;export CCACHE_DISABLE=1;export SAI_CPACK=\"-G RPM\";cmake .. ${cmake} && make -j4 && make -j DESTDIR=../destdir install && ctest -j4 --output-on-failure ${cpack}"
 		},
@@ -172,7 +175,7 @@
 		"mbedtls": {
 			"cmake":	"-DLWS_WITH_MBEDTLS=1 -DLWS_WITH_HTTP2=1 -DLWS_WITH_LWSWS=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_JOSE=1 -DCMAKE_BUILD_TYPE=DEBUG",
 			# no distro -devel package for mbedtls
-			"platforms":	"not linux-centos-8/x86_64-amd/gcc"
+			"platforms":	"not linux-centos-7/x86_64-amd/gcc, not linux-centos-8/x86_64-amd/gcc"
 		},
 		"noserver": {
 			"cmake":	"-DLWS_WITHOUT_SERVER=ON -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_SECURE_STREAMS=1"
diff --git a/lib/roles/http/server/lws-spa.c b/lib/roles/http/server/lws-spa.c
index 18325ab19..61d6d40d0 100644
--- a/lib/roles/http/server/lws-spa.c
+++ b/lib/roles/http/server/lws-spa.c
@@ -366,7 +366,7 @@ retry_as_first:
 			}
 
 			if (*in == '\"') {
-				s->inside_quote ^= 1;
+				s->inside_quote = !!((s->inside_quote ^ 1) & 1);
 				goto done;
 			}
 
diff --git a/lib/roles/mqtt/mqtt.c b/lib/roles/mqtt/mqtt.c
index 96e9bb47d..20ebf9844 100644
--- a/lib/roles/mqtt/mqtt.c
+++ b/lib/roles/mqtt/mqtt.c
@@ -1323,7 +1323,7 @@ bail1:
 			case LMSPR_NEED_MORE:
 				break;
 			case LMSPR_COMPLETED:
-				par->consumed = (uint32_t)((unsigned int)par->consumed + (unsigned int)par->vbit.consumed);
+				par->consumed = (uint32_t)((unsigned int)par->consumed + (unsigned int)(unsigned char)par->vbit.consumed);
 				if (par->vbit.value >
 				    LWS_ARRAY_SIZE(property_valid)) {
 					lwsl_notice("%s: undef prop id 0x%x\n",
diff --git a/lib/roles/netlink/ops-netlink.c b/lib/roles/netlink/ops-netlink.c
index f167e3b47..37d61972b 100644
--- a/lib/roles/netlink/ops-netlink.c
+++ b/lib/roles/netlink/ops-netlink.c
@@ -36,6 +36,10 @@
 #include <linux/netlink.h>
 #include <linux/rtnetlink.h>
 
+/* work around CentOS 7 -Wconversion problem */
+#undef RTA_ALIGNTO
+#define RTA_ALIGNTO 4U
+
 static void
 lws_netlink_coldplug_done_cb(lws_sorted_usec_list_t *sul)
 {
diff --git a/lib/secure-streams/secure-streams-serialize.c b/lib/secure-streams/secure-streams-serialize.c
index 833ae16a5..7223736e0 100644
--- a/lib/secure-streams/secure-streams-serialize.c
+++ b/lib/secure-streams/secure-streams-serialize.c
@@ -384,7 +384,7 @@ lws_ss_deserialize_parse(struct lws_ss_serialization_parser *par,
 			break;
 
 		case RPAR_LEN_LSB:
-			par->rem |= (uint16_t)*cp++;
+			par->rem = (uint16_t)(par->rem | *cp++);
 			switch (par->type) {
 
 			/* event loop side */
diff --git a/lib/system/smd/smd.c b/lib/system/smd/smd.c
index ed754bab4..c1f763c8e 100644
--- a/lib/system/smd/smd.c
+++ b/lib/system/smd/smd.c
@@ -532,7 +532,7 @@ lws_smd_msg_distribute(struct lws_context *ctx)
 			lws_smd_peer_t *pr = lws_container_of(p, lws_smd_peer_t, list);
 
 			/* may destroy pr if zombie, hence _safe iterator */
-			more |= (char)!!_lws_smd_msg_deliver_peer(ctx, pr);
+			more = (char)(more | !!_lws_smd_msg_deliver_peer(ctx, pr));
 
 		} lws_end_foreach_dll_safe(p, p1);
 
diff --git a/lib/tls/openssl/lws-genec.c b/lib/tls/openssl/lws-genec.c
index d5f69c374..1e953b722 100644
--- a/lib/tls/openssl/lws-genec.c
+++ b/lib/tls/openssl/lws-genec.c
@@ -66,7 +66,7 @@ int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen)
 
     /* Add leading zeroes if necessary */
     if (tolen > i) {
-        memset(to, 0, tolen - i);
+        memset(to, 0, (size_t)(tolen - i));
         to += tolen - i;
     }
     while (i--) {
diff --git a/lib/tls/openssl/openssl-client.c b/lib/tls/openssl/openssl-client.c
index 67e0a790f..ad7d2de7b 100644
--- a/lib/tls/openssl/openssl-client.c
+++ b/lib/tls/openssl/openssl-client.c
@@ -762,7 +762,11 @@ lws_tls_client_create_vhost_context(struct lws_vhost *vh,
 #if defined(LWS_WITH_BORINGSSL)
 				(uint32_t)
 #else
+#if (OPENSSL_VERSION_NUMBER >= 0x10003000l) /* not documented by openssl */
 				    (unsigned long)
+#else
+				    (long)
+#endif
 #endif
 #endif
 				    info->ssl_client_options_set);
@@ -774,7 +778,11 @@ lws_tls_client_create_vhost_context(struct lws_vhost *vh,
 #if defined(LWS_WITH_BORINGSSL)
 				(uint32_t)
 #else
-				      (unsigned long)
+#if (OPENSSL_VERSION_NUMBER >= 0x10003000l) /* not documented by openssl */
+				    (unsigned long)
+#else
+				    (long)
+#endif
 #endif
 				      info->ssl_client_options_clear);
 #endif
diff --git a/lib/tls/openssl/openssl-server.c b/lib/tls/openssl/openssl-server.c
index c4c36db0c..d7b4b2078 100644
--- a/lib/tls/openssl/openssl-server.c
+++ b/lib/tls/openssl/openssl-server.c
@@ -581,7 +581,11 @@ lws_tls_server_vhost_backend_init(const struct lws_context_creation_info *info,
 #if defined(LWS_WITH_BORINGSSL)
 				(uint32_t)
 #else
-				(unsigned long)
+#if (OPENSSL_VERSION_NUMBER >= 0x10003000l) /* not documented by openssl */
+				    (unsigned long)
+#else
+				    (long)
+#endif
 #endif
 #endif
 				info->ssl_options_set);
@@ -593,7 +597,11 @@ lws_tls_server_vhost_backend_init(const struct lws_context_creation_info *info,
 #if defined(LWS_WITH_BORINGSSL)
 				(uint32_t)
 #else
-				      (unsigned long)
+#if (OPENSSL_VERSION_NUMBER >= 0x10003000l) /* not documented by openssl */
+				    (unsigned long)
+#else
+				    (long)
+#endif
 #endif
 				      info->ssl_options_clear);
 #endif
diff --git a/lib/tls/openssl/openssl-tls.c b/lib/tls/openssl/openssl-tls.c
index e6ac94585..e56c5e056 100644
--- a/lib/tls/openssl/openssl-tls.c
+++ b/lib/tls/openssl/openssl-tls.c
@@ -158,8 +158,8 @@ lws_context_init_ssl_library(const struct lws_context_creation_info *info)
 		int n;
 
 		openssl_mutexes = (pthread_mutex_t *)
-				OPENSSL_malloc(CRYPTO_num_locks() *
-					       sizeof(openssl_mutexes[0]));
+				OPENSSL_malloc((size_t)((unsigned long)CRYPTO_num_locks() *
+					       (unsigned long)sizeof(openssl_mutexes[0])));
 
 		for (n = 0; n < CRYPTO_num_locks(); n++)
 			pthread_mutex_init(&openssl_mutexes[n], NULL);
diff --git a/plugins/acme-client/protocol_lws_acme_client.c b/plugins/acme-client/protocol_lws_acme_client.c
index bdb52b1ef..afd64a054 100644
--- a/plugins/acme-client/protocol_lws_acme_client.c
+++ b/plugins/acme-client/protocol_lws_acme_client.c
@@ -98,7 +98,7 @@ struct acme_connection {
 
 	size_t len_privkey_pem;
 
-	unsigned int yes:2;
+	unsigned int yes;
 	unsigned int use:1;
 	unsigned int is_sni_02:1;
 };
@@ -496,7 +496,7 @@ cb_authz(struct lejp_ctx *ctx, char reason)
 		if (s->use) {
 			lws_strncpy(s->challenge_uri, ctx->buf,
 				    sizeof(s->challenge_uri));
-			s->yes |= 2;
+			s->yes = s->yes | 2;
 		}
 		break;
 	case JAAZ_CHALLENGES_TOKEN:
@@ -504,7 +504,7 @@ cb_authz(struct lejp_ctx *ctx, char reason)
 		if (s->use) {
 			lws_strncpy(s->chall_token, ctx->buf,
 				    sizeof(s->chall_token));
-			s->yes |= 1;
+			s->yes = s->yes | 1;
 		}
 		break;
 	}
@@ -552,11 +552,11 @@ cb_chac(struct lejp_ctx *ctx, char reason)
 		lws_strncpy(s->status, ctx->buf, sizeof(s->status));
 		break;
 	case JCAC_URI:
-		s->yes |= 2;
+		s->yes = s->yes | 2;
 		break;
 	case JCAC_TOKEN:
 		lws_strncpy(s->chall_token, ctx->buf, sizeof(s->chall_token));
-		s->yes |= 1;
+		s->yes = s->yes | 1;
 		break;
 	case JCAC_DETAIL:
 		lws_snprintf(s->detail, sizeof(s->detail), "%s", ctx->buf);