diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index 9bcfe48f1..7f503c3ee 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -189,15 +189,6 @@
 	    #define XREALLOC(p, n, h, t) wolfSSL_Realloc((p), (n))
 	#endif
 
-    #ifdef WOLFSSL_CERT_EXT
-        /* use only Thread Safe version of strtok */
-        #ifndef USE_WINDOWS_API
-            #define XSTRTOK strtok_r
-        #else
-            #define XSTRTOK strtok_s
-        #endif
-    #endif
-
 	#ifndef STRING_USER
 	    #include <string.h>
 	    char* mystrnstr(const char* s1, const char* s2, unsigned int n);
@@ -209,8 +200,8 @@
 
 	    #define XSTRLEN(s1)       strlen((s1))
 	    #define XSTRNCPY(s1,s2,n) strncpy((s1),(s2),(n))
-	    /* strstr, strncmp, and strncat only used by wolfSSL proper, not required for
-	       CTaoCrypt only */
+	    /* strstr, strncmp, and strncat only used by wolfSSL proper,
+         * not required for wolfCrypt only */
 	    #define XSTRSTR(s1,s2)    strstr((s1),(s2))
 	    #define XSTRNSTR(s1,s2,n) mystrnstr((s1),(s2),(n))
 	    #define XSTRNCMP(s1,s2,n) strncmp((s1),(s2),(n))
@@ -220,6 +211,15 @@
 	    #else
 	        #define XSTRNCASECMP(s1,s2,n) _strnicmp((s1),(s2),(n))
 	    #endif
+
+        #ifdef WOLFSSL_CERT_EXT
+            /* use only Thread Safe version of strtok */
+            #ifndef USE_WINDOWS_API
+                #define XSTRTOK strtok_r
+            #else
+                #define XSTRTOK strtok_s
+            #endif
+        #endif
 	#endif
 
 	#ifndef CTYPE_USER