diff --git a/include/mbedtls/x509_crl.h b/include/mbedtls/x509_crl.h
index fcaa149..440da12 100644
--- a/include/mbedtls/x509_crl.h
+++ b/include/mbedtls/x509_crl.h
@@ -21,6 +21,7 @@
  */
 #ifndef MBEDTLS_X509_CRL_H
 #define MBEDTLS_X509_CRL_H
+#include "mbedtls/private_access.h"
 
 #if !defined(MBEDTLS_CONFIG_FILE)
 #include "mbedtls/config.h"
@@ -49,15 +50,15 @@
  */
 typedef struct mbedtls_x509_crl_entry
 {
-    mbedtls_x509_buf raw;
+    mbedtls_x509_buf MBEDTLS_PRIVATE(raw);
 
-    mbedtls_x509_buf serial;
+    mbedtls_x509_buf MBEDTLS_PRIVATE(serial);
 
-    mbedtls_x509_time revocation_date;
+    mbedtls_x509_time MBEDTLS_PRIVATE(revocation_date);
 
-    mbedtls_x509_buf entry_ext;
+    mbedtls_x509_buf MBEDTLS_PRIVATE(entry_ext);
 
-    struct mbedtls_x509_crl_entry *next;
+    struct mbedtls_x509_crl_entry *MBEDTLS_PRIVATE(next);
 }
 mbedtls_x509_crl_entry;
 
@@ -67,30 +68,30 @@
  */
 typedef struct mbedtls_x509_crl
 {
-    mbedtls_x509_buf raw;           /**< The raw certificate data (DER). */
-    mbedtls_x509_buf tbs;           /**< The raw certificate body (DER). The part that is To Be Signed. */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(raw);           /**< The raw certificate data (DER). */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(tbs);           /**< The raw certificate body (DER). The part that is To Be Signed. */
 
-    int version;            /**< CRL version (1=v1, 2=v2) */
-    mbedtls_x509_buf sig_oid;       /**< CRL signature type identifier */
+    int MBEDTLS_PRIVATE(version);            /**< CRL version (1=v1, 2=v2) */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(sig_oid);       /**< CRL signature type identifier */
 
-    mbedtls_x509_buf issuer_raw;    /**< The raw issuer data (DER). */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(issuer_raw);    /**< The raw issuer data (DER). */
 
-    mbedtls_x509_name issuer;       /**< The parsed issuer data (named information object). */
+    mbedtls_x509_name MBEDTLS_PRIVATE(issuer);       /**< The parsed issuer data (named information object). */
 
-    mbedtls_x509_time this_update;
-    mbedtls_x509_time next_update;
+    mbedtls_x509_time MBEDTLS_PRIVATE(this_update);
+    mbedtls_x509_time MBEDTLS_PRIVATE(next_update);
 
-    mbedtls_x509_crl_entry entry;   /**< The CRL entries containing the certificate revocation times for this CA. */
+    mbedtls_x509_crl_entry MBEDTLS_PRIVATE(entry);   /**< The CRL entries containing the certificate revocation times for this CA. */
 
-    mbedtls_x509_buf crl_ext;
+    mbedtls_x509_buf MBEDTLS_PRIVATE(crl_ext);
 
-    mbedtls_x509_buf sig_oid2;
-    mbedtls_x509_buf sig;
-    mbedtls_md_type_t sig_md;           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
-    mbedtls_pk_type_t sig_pk;           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */
-    void *sig_opts;             /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */
+    mbedtls_x509_buf MBEDTLS_PRIVATE(sig_oid2);
+    mbedtls_x509_buf MBEDTLS_PRIVATE(sig);
+    mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md);           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
+    mbedtls_pk_type_t MBEDTLS_PRIVATE(sig_pk);           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */
+    void *MBEDTLS_PRIVATE(sig_opts);             /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */
 
-    struct mbedtls_x509_crl *next;
+    struct mbedtls_x509_crl *MBEDTLS_PRIVATE(next);
 }
 mbedtls_x509_crl;