diff --git a/lib/tls/mbedtls/lws-genhash.c b/lib/tls/mbedtls/lws-genhash.c
index 55a4a128..ce4ee6e3 100644
--- a/lib/tls/mbedtls/lws-genhash.c
+++ b/lib/tls/mbedtls/lws-genhash.c
@@ -22,6 +22,13 @@
  *  same whether you are using openssl or mbedtls hash functions underneath.
  */
 #include "libwebsockets.h"
+#include <mbedtls/version.h>
+
+#if (MBEDTLS_VERSION_NUMBER >= 0x02070000)
+#define MBA(fn) fn##_ret
+#else
+#define MBA(fn) fn
+#endif
 
 size_t
 lws_genhash_size(enum lws_genhash_types type)
@@ -48,19 +55,19 @@ lws_genhash_init(struct lws_genhash_ctx *ctx, enum lws_genhash_types type)
 	switch (ctx->type) {
 	case LWS_GENHASH_TYPE_SHA1:
 		mbedtls_sha1_init(&ctx->u.sha1);
-		mbedtls_sha1_starts(&ctx->u.sha1);
+		MBA(mbedtls_sha1_starts)(&ctx->u.sha1);
 		break;
 	case LWS_GENHASH_TYPE_SHA256:
 		mbedtls_sha256_init(&ctx->u.sha256);
-		mbedtls_sha256_starts(&ctx->u.sha256, 0);
+		MBA(mbedtls_sha256_starts)(&ctx->u.sha256, 0);
 		break;
 	case LWS_GENHASH_TYPE_SHA384:
 		mbedtls_sha512_init(&ctx->u.sha512);
-		mbedtls_sha512_starts(&ctx->u.sha512, 1 /* is384 */);
+		MBA(mbedtls_sha512_starts)(&ctx->u.sha512, 1 /* is384 */);
 		break;
 	case LWS_GENHASH_TYPE_SHA512:
 		mbedtls_sha512_init(&ctx->u.sha512);
-		mbedtls_sha512_starts(&ctx->u.sha512, 0);
+		MBA(mbedtls_sha512_starts)(&ctx->u.sha512, 0);
 		break;
 	default:
 		return 1;
@@ -74,16 +81,16 @@ lws_genhash_update(struct lws_genhash_ctx *ctx, const void *in, size_t len)
 {
 	switch (ctx->type) {
 	case LWS_GENHASH_TYPE_SHA1:
-		mbedtls_sha1_update(&ctx->u.sha1, in, len);
+		MBA(mbedtls_sha1_update)(&ctx->u.sha1, in, len);
 		break;
 	case LWS_GENHASH_TYPE_SHA256:
-		mbedtls_sha256_update(&ctx->u.sha256, in, len);
+		MBA(mbedtls_sha256_update)(&ctx->u.sha256, in, len);
 		break;
 	case LWS_GENHASH_TYPE_SHA384:
-		mbedtls_sha512_update(&ctx->u.sha512, in, len);
+		MBA(mbedtls_sha512_update)(&ctx->u.sha512, in, len);
 		break;
 	case LWS_GENHASH_TYPE_SHA512:
-		mbedtls_sha512_update(&ctx->u.sha512, in, len);
+		MBA(mbedtls_sha512_update)(&ctx->u.sha512, in, len);
 		break;
 	}
 
@@ -95,19 +102,19 @@ lws_genhash_destroy(struct lws_genhash_ctx *ctx, void *result)
 {
 	switch (ctx->type) {
 	case LWS_GENHASH_TYPE_SHA1:
-		mbedtls_sha1_finish(&ctx->u.sha1, result);
+		MBA(mbedtls_sha1_finish)(&ctx->u.sha1, result);
 		mbedtls_sha1_free(&ctx->u.sha1);
 		break;
 	case LWS_GENHASH_TYPE_SHA256:
-		mbedtls_sha256_finish(&ctx->u.sha256, result);
+		MBA(mbedtls_sha256_finish)(&ctx->u.sha256, result);
 		mbedtls_sha256_free(&ctx->u.sha256);
 		break;
 	case LWS_GENHASH_TYPE_SHA384:
-		mbedtls_sha512_finish(&ctx->u.sha512, result);
+		MBA(mbedtls_sha512_finish)(&ctx->u.sha512, result);
 		mbedtls_sha512_free(&ctx->u.sha512);
 		break;
 	case LWS_GENHASH_TYPE_SHA512:
-		mbedtls_sha512_finish(&ctx->u.sha512, result);
+		MBA(mbedtls_sha512_finish)(&ctx->u.sha512, result);
 		mbedtls_sha512_free(&ctx->u.sha512);
 		break;
 	}