diff --git a/src/session_base.cpp b/src/session_base.cpp
index d6200b15..cbd923d8 100644
--- a/src/session_base.cpp
+++ b/src/session_base.cpp
@@ -117,17 +117,9 @@ zmq::session_base_t::session_base_t (class io_thread_t *io_thread_,
     _addr (addr_)
 #ifdef ZMQ_HAVE_WSS
     ,
-    _wss_hostname (NULL)
+    _wss_hostname (options_.wss_hostname)
 #endif
 {
-#ifdef ZMQ_HAVE_WSS
-    if (options_.wss_hostname.length () > 0) {
-        _wss_hostname =
-          static_cast<char *> (malloc (options_.wss_hostname.length () + 1));
-        assert (_wss_hostname);
-        strcpy (_wss_hostname, options_.wss_hostname.c_str ());
-    }
-#endif
 }
 
 const zmq::endpoint_uri_pair_t &zmq::session_base_t::get_endpoint () const
@@ -150,11 +142,6 @@ zmq::session_base_t::~session_base_t ()
     if (_engine)
         _engine->terminate ();
 
-#ifdef ZMQ_HAVE_WSS
-    if (_wss_hostname)
-        free (_wss_hostname);
-#endif
-
     LIBZMQ_DELETE (_addr);
 }
 
@@ -708,8 +695,8 @@ zmq::own_t *zmq::session_base_t::create_connecter_tcp (io_thread_t *io_thread_,
 zmq::own_t *zmq::session_base_t::create_connecter_ws (io_thread_t *io_thread_,
                                                       bool wait_)
 {
-    return new (std::nothrow)
-      ws_connecter_t (io_thread_, this, options, _addr, wait_, false, NULL);
+    return new (std::nothrow) ws_connecter_t (io_thread_, this, options, _addr,
+                                              wait_, false, std::string ());
 }
 #endif
 
diff --git a/src/session_base.hpp b/src/session_base.hpp
index ed2772c1..42b84e6d 100644
--- a/src/session_base.hpp
+++ b/src/session_base.hpp
@@ -195,7 +195,7 @@ class session_base_t : public own_t, public io_object_t, public i_pipe_events
 #ifdef ZMQ_HAVE_WSS
     //  TLS handshake, we need to take a copy when the session is created,
     //  in order to maintain the value at the creation time
-    char *_wss_hostname;
+    const std::string _wss_hostname;
 #endif
 
     ZMQ_NON_COPYABLE_NOR_MOVABLE (session_base_t)
diff --git a/src/ws_connecter.cpp b/src/ws_connecter.cpp
index ca189d63..29b551cc 100644
--- a/src/ws_connecter.cpp
+++ b/src/ws_connecter.cpp
@@ -74,7 +74,7 @@ zmq::ws_connecter_t::ws_connecter_t (class io_thread_t *io_thread_,
                                      address_t *addr_,
                                      bool delayed_start_,
                                      bool wss_,
-                                     const char *tls_hostname_) :
+                                     const std::string &tls_hostname_) :
     stream_connecter_base_t (
       io_thread_, session_, options_, addr_, delayed_start_),
     _connect_timer_started (false),
diff --git a/src/ws_connecter.hpp b/src/ws_connecter.hpp
index 50d27d0a..20b8b1b9 100644
--- a/src/ws_connecter.hpp
+++ b/src/ws_connecter.hpp
@@ -47,7 +47,7 @@ class ws_connecter_t : public stream_connecter_base_t
                     address_t *addr_,
                     bool delayed_start_,
                     bool wss_,
-                    const char *tls_hostname_);
+                    const std::string &tls_hostname_);
     ~ws_connecter_t ();
 
   protected:
@@ -89,7 +89,7 @@ class ws_connecter_t : public stream_connecter_base_t
     bool _connect_timer_started;
 
     bool _wss;
-    const char *_hostname;
+    const std::string &_hostname;
 
     ZMQ_NON_COPYABLE_NOR_MOVABLE (ws_connecter_t)
 };
diff --git a/src/ws_listener.cpp b/src/ws_listener.cpp
index d86e49e1..aa53752d 100644
--- a/src/ws_listener.cpp
+++ b/src/ws_listener.cpp
@@ -294,8 +294,9 @@ void zmq::ws_listener_t::create_engine (fd_t fd_)
     i_engine *engine = NULL;
     if (_wss)
 #ifdef ZMQ_HAVE_WSS
-        engine = new (std::nothrow) wss_engine_t (
-          fd_, options, endpoint_pair, _address, false, _tls_cred, NULL);
+        engine = new (std::nothrow)
+          wss_engine_t (fd_, options, endpoint_pair, _address, false, _tls_cred,
+                        std::string ());
 #else
         assert (false);
 #endif
diff --git a/src/wss_engine.cpp b/src/wss_engine.cpp
index c3f2b05a..f5a4645d 100644
--- a/src/wss_engine.cpp
+++ b/src/wss_engine.cpp
@@ -58,7 +58,7 @@ zmq::wss_engine_t::wss_engine_t (fd_t fd_,
                                  ws_address_t &address_,
                                  bool client_,
                                  void *tls_server_cred_,
-                                 const char *hostname_) :
+                                 const std::string &hostname_) :
     ws_engine_t (fd_, options_, endpoint_uri_pair_, address_, client_),
     _established (false),
     _tls_client_cred (NULL)
@@ -88,11 +88,13 @@ zmq::wss_engine_t::wss_engine_t (fd_t fd_,
         rc = gnutls_init (&_tls_session, GNUTLS_CLIENT | GNUTLS_NONBLOCK);
         assert (rc == GNUTLS_E_SUCCESS);
 
-        if (hostname_)
-            gnutls_server_name_set (_tls_session, GNUTLS_NAME_DNS, hostname_,
-                                    strlen (hostname_));
+        if (!hostname_.empty ())
+            gnutls_server_name_set (_tls_session, GNUTLS_NAME_DNS,
+                                    hostname_.c_str (), hostname_.size ());
 
-        gnutls_session_set_ptr (_tls_session, (void *) hostname_);
+        gnutls_session_set_ptr (
+          _tls_session,
+          hostname_.empty () ? NULL : const_cast<char *> (hostname_.c_str ()));
 
         rc = gnutls_credentials_set (_tls_session, GNUTLS_CRD_CERTIFICATE,
                                      _tls_client_cred);
diff --git a/src/wss_engine.hpp b/src/wss_engine.hpp
index 1f744e83..adfaf454 100644
--- a/src/wss_engine.hpp
+++ b/src/wss_engine.hpp
@@ -46,7 +46,7 @@ class wss_engine_t : public ws_engine_t
                   ws_address_t &address_,
                   bool client_,
                   void *tls_server_cred_,
-                  const char *hostname_);
+                  const std::string &hostname_);
     ~wss_engine_t ();
 
     void out_event ();