diff --git a/pdns/dnssecsigner.cc b/pdns/dnssecsigner.cc
index 06ac28ce993d..24489e2b4fb0 100644
--- a/pdns/dnssecsigner.cc
+++ b/pdns/dnssecsigner.cc
@@ -31,9 +31,11 @@
 #include "lock.hh"
 #include "arguments.hh"
 #include "statbag.hh"
+#include "sha.hh"
+
 extern StatBag S;
 
-typedef map<pair<string, string>, string> signaturecache_t;
+using signaturecache_t = map<pair<string, string>, string>;
 static SharedLockGuarded<signaturecache_t> g_signatures;
 static int g_cacheweekno;
 
@@ -58,7 +60,7 @@ static std::string getLookupKeyFromPublicKey(const std::string& pubKey)
   if (pubKey.size() <= 64) {
     return pubKey;
   }
-  return pdns_sha1sum(pubKey);
+  return pdns::sha1sum(pubKey);
 }
 
 static void fillOutRRSIG(DNSSECPrivateKey& dpk, const DNSName& signQName, RRSIGRecordContent& rrc, const sortedRecords_t& toSign)
diff --git a/pdns/pkcs11signers.cc b/pdns/pkcs11signers.cc
index d7ecd3f5e245..dc53f2930752 100644
--- a/pdns/pkcs11signers.cc
+++ b/pdns/pkcs11signers.cc
@@ -908,19 +908,19 @@ std::string PKCS11DNSCryptoKeyEngine::hash(const std::string& msg) const {
     // FINE! I'll do this myself, then, shall I?
     switch(d_algorithm) {
     case 5: {
-      return pdns_sha1sum(msg);
+      return pdns::sha1sum(msg);
     }
     case 8: {
-      return pdns_sha256sum(msg);
+      return pdns::sha256sum(msg);
     }
     case 10: {
-      return pdns_sha512sum(msg);
+      return pdns::sha512sum(msg);
     }
     case 13: {
-      return pdns_sha256sum(msg);
+      return pdns::sha256sum(msg);
     }
     case 14: {
-      return pdns_sha384sum(msg);
+      return pdns::sha384sum(msg);
     }
     };
   };
diff --git a/pdns/sha.hh b/pdns/sha.hh
index 92e6d387be9f..a5396d06e194 100644
--- a/pdns/sha.hh
+++ b/pdns/sha.hh
@@ -21,40 +21,48 @@
  */
 #pragma once
 
+#include "config.h"
+#include <array>
+#include <memory>
+#include <stdexcept>
 #include <string>
 #include <openssl/sha.h>
 #include <openssl/evp.h>
 
-inline std::string pdns_sha1sum(const std::string& input)
+namespace pdns
+{
+inline std::string sha1sum(const std::string& input)
 {
-  unsigned char result[20] = {0};
-  SHA1(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result);
-  return std::string(result, result + sizeof result);
+  std::array<unsigned char, 20> result{};
+  // NOLINTNEXTLINE(*-cast): Using OpenSSL C APIs.
+  SHA1(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result.data());
+  return {result.begin(), result.end()};
 }
 
-inline std::string pdns_sha256sum(const std::string& input)
+inline std::string sha256sum(const std::string& input)
 {
-  unsigned char result[32] = {0};
-  SHA256(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result);
-  return std::string(result, result + sizeof result);
+  std::array<unsigned char, 32> result{};
+  // NOLINTNEXTLINE(*-cast): Using OpenSSL C APIs.
+  SHA256(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result.data());
+  return {result.begin(), result.end()};
 }
 
-inline std::string pdns_sha384sum(const std::string& input)
+inline std::string sha384sum(const std::string& input)
 {
-  unsigned char result[48] = {0};
-  SHA384(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result);
-  return std::string(result, result + sizeof result);
+  std::array<unsigned char, 48> result{};
+  // NOLINTNEXTLINE(*-cast): Using OpenSSL C APIs.
+  SHA384(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result.data());
+  return {result.begin(), result.end()};
 }
 
-inline std::string pdns_sha512sum(const std::string& input)
+inline std::string sha512sum(const std::string& input)
 {
-  unsigned char result[64] = {0};
-  SHA512(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result);
-  return std::string(result, result + sizeof result);
+  std::array<unsigned char, 64> result{};
+  // NOLINTNEXTLINE(*-cast): Using OpenSSL C APIs.
+  SHA512(reinterpret_cast<const unsigned char*>(input.c_str()), input.length(), result.data());
+  return {result.begin(), result.end()};
 }
 
-namespace pdns
-{
 class SHADigest
 {
 public:
@@ -83,7 +91,7 @@ public:
     default:
       throw std::invalid_argument("SHADigest: unsupported size");
     }
-    if (EVP_DigestInit_ex(mdctx.get(), md, NULL) == 0) {
+    if (EVP_DigestInit_ex(mdctx.get(), md, nullptr) == 0) {
       throw std::runtime_error("SHADigest: init error");
     }
   }
@@ -102,7 +110,7 @@ public:
   {
     std::string md_value;
     md_value.resize(EVP_MD_size(md));
-    unsigned int md_len;
+    unsigned int md_len = 0;
     if (EVP_DigestFinal_ex(mdctx.get(), reinterpret_cast<unsigned char*>(md_value.data()), &md_len) == 0) {
       throw std::runtime_error("SHADigest: finalize error");
     }
diff --git a/pdns/test-sha_hh.cc b/pdns/test-sha_hh.cc
index 54ead9dd8a94..f814447ff360 100644
--- a/pdns/test-sha_hh.cc
+++ b/pdns/test-sha_hh.cc
@@ -21,15 +21,15 @@ using namespace boost::assign;
 BOOST_AUTO_TEST_SUITE(test_sha_hh)
 
 // input, output
-typedef boost::tuple<const std::string, const std::string> case_t;
-typedef std::vector<case_t> cases_t;
+using case_t = boost::tuple<const std::string, const std::string>;
+using cases_t = std::vector<case_t>;
 
 BOOST_AUTO_TEST_CASE(test_sha1)
 {
   cases_t cases = list_of(case_t("abc", "a9 99 3e 36 47 06 81 6a ba 3e 25 71 78 50 c2 6c 9c d0 d8 9d "))(case_t("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "84 98 3e 44 1c 3b d2 6e ba ae 4a a1 f9 51 29 e5 e5 46 70 f1 "));
 
   for (case_t& val : cases) {
-    BOOST_CHECK_EQUAL(makeHexDump(pdns_sha1sum(val.get<0>())), val.get<1>());
+    BOOST_CHECK_EQUAL(makeHexDump(pdns::sha1sum(val.get<0>())), val.get<1>());
   }
 }
 
@@ -38,7 +38,7 @@ BOOST_AUTO_TEST_CASE(test_sha256)
   cases_t cases = list_of(case_t("abc", "ba 78 16 bf 8f 01 cf ea 41 41 40 de 5d ae 22 23 b0 03 61 a3 96 17 7a 9c b4 10 ff 61 f2 00 15 ad "))(case_t("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "24 8d 6a 61 d2 06 38 b8 e5 c0 26 93 0c 3e 60 39 a3 3c e4 59 64 ff 21 67 f6 ec ed d4 19 db 06 c1 "));
 
   for (case_t& val : cases) {
-    BOOST_CHECK_EQUAL(makeHexDump(pdns_sha256sum(val.get<0>())), val.get<1>());
+    BOOST_CHECK_EQUAL(makeHexDump(pdns::sha256sum(val.get<0>())), val.get<1>());
   }
 }
 
@@ -47,7 +47,7 @@ BOOST_AUTO_TEST_CASE(test_sha384)
   cases_t cases = list_of(case_t("abc", "cb 00 75 3f 45 a3 5e 8b b5 a0 3d 69 9a c6 50 07 27 2c 32 ab 0e de d1 63 1a 8b 60 5a 43 ff 5b ed 80 86 07 2b a1 e7 cc 23 58 ba ec a1 34 c8 25 a7 "))(case_t("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "33 91 fd dd fc 8d c7 39 37 07 a6 5b 1b 47 09 39 7c f8 b1 d1 62 af 05 ab fe 8f 45 0d e5 f3 6b c6 b0 45 5a 85 20 bc 4e 6f 5f e9 5b 1f e3 c8 45 2b "));
 
   for (case_t& val : cases) {
-    BOOST_CHECK_EQUAL(makeHexDump(pdns_sha384sum(val.get<0>())), val.get<1>());
+    BOOST_CHECK_EQUAL(makeHexDump(pdns::sha384sum(val.get<0>())), val.get<1>());
   }
 }
 
@@ -56,7 +56,7 @@ BOOST_AUTO_TEST_CASE(test_sha512)
   cases_t cases = list_of(case_t("abc", "dd af 35 a1 93 61 7a ba cc 41 73 49 ae 20 41 31 12 e6 fa 4e 89 a9 7e a2 0a 9e ee e6 4b 55 d3 9a 21 92 99 2a 27 4f c1 a8 36 ba 3c 23 a3 fe eb bd 45 4d 44 23 64 3c e8 0e 2a 9a c9 4f a5 4c a4 9f "))(case_t("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "20 4a 8f c6 dd a8 2f 0a 0c ed 7b eb 8e 08 a4 16 57 c1 6e f4 68 b2 28 a8 27 9b e3 31 a7 03 c3 35 96 fd 15 c1 3b 1b 07 f9 aa 1d 3b ea 57 78 9c a0 31 ad 85 c7 a7 1d d7 03 54 ec 63 12 38 ca 34 45 "));
 
   for (case_t& val : cases) {
-    BOOST_CHECK_EQUAL(makeHexDump(pdns_sha512sum(val.get<0>())), val.get<1>());
+    BOOST_CHECK_EQUAL(makeHexDump(pdns::sha512sum(val.get<0>())), val.get<1>());
   }
 }