diff --git a/src/IO/tls_openssl.cc b/src/IO/tls_openssl.cc
index 179a5b0..2158fea 100644
--- a/src/IO/tls_openssl.cc
+++ b/src/IO/tls_openssl.cc
@@ -68,6 +68,7 @@
 #include <string>
 #include <vector>
 #include <memory>
+#include <sstream>
 #include <algorithm>
 using namespace std::literals::string_literals;
 
@@ -615,9 +616,9 @@ static bool Tls_check_cert_hostname(X509 *cert, const char *host,
     {
       /* Test subject alternative names */
 
-      Dstr *err = dStr_new("");
-      dStr_sprintf(err, "Hostname %s does not match any of certificate's "
-                        "Subject Alternative Names: ", host);
+      std::ostringstream err;
+      err << "Hostname " << host << " does not match any of certificate's "
+                        "Subject Alternative Names: ";
 
       /* Do we want to check for dNSNAmes or ipAddresses (see RFC 2818)?
        * Signal it by host_in_octet_string. */
@@ -642,7 +643,7 @@ static bool Tls_check_cert_hostname(X509 *cert, const char *host,
                       if (!ASN1_STRING_cmp (host_in_octet_string,
                             name->d.iPAddress))
                         break;
-                      dStr_sprintfa(err, "%s ", name->d.iPAddress);
+                      err << name->d.iPAddress;
                     }
                 }
               else if (name->type == GEN_DNS)
@@ -664,7 +665,7 @@ static bool Tls_check_cert_hostname(X509 *cert, const char *host,
                           OPENSSL_free (name_in_utf8);
                           break;
                         }
-                      dStr_sprintfa(err, "%s ", name_in_utf8);
+                      err << name_in_utf8;
                       OPENSSL_free (name_in_utf8);
                     }
                 }
@@ -678,7 +679,7 @@ static bool Tls_check_cert_hostname(X509 *cert, const char *host,
         {
          success = false;
          *choice = a_Dialog_choice("Flenser TLS security warning",
-            err->str, "Continue", "Cancel", NULL);
+            err.str().c_str(), "Continue", "Cancel", NULL);
 
          switch (*choice){
             case 1:
@@ -690,7 +691,6 @@ static bool Tls_check_cert_hostname(X509 *cert, const char *host,
                break;
          }
         }
-      dStr_free(err, 1);
     }
 
   if (alt_name_checked == false)