diff --git a/lib/base/application.cpp b/lib/base/application.cpp
index 49d2d39a0..0264f7324 100644
--- a/lib/base/application.cpp
+++ b/lib/base/application.cpp
@@ -95,7 +95,7 @@ void Application::Stop(void)
 	if (l_Restarting) {
 		try {
 			UpdatePidFile(GetPidPath(), m_ReloadProcess);
-		} catch (std::exception&) {
+		} catch (const std::exception&) {
 			/* abort restart */
 			Log(LogCritical, "Application", "Cannot update PID file. Aborting restart operation.");
 			return;
@@ -667,7 +667,7 @@ int Application::Run(void)
 
 	try {
 		UpdatePidFile(GetPidPath());
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		Log(LogCritical, "Application", "Cannot update PID file '" + GetPidPath() + "'. Aborting.");
 		return false;
 	}
diff --git a/lib/base/convert.hpp b/lib/base/convert.hpp
index 7d77abe93..7a6db2628 100644
--- a/lib/base/convert.hpp
+++ b/lib/base/convert.hpp
@@ -40,7 +40,7 @@ public:
 	{
 		try {
 			return boost::lexical_cast<long>(val);
-		} catch (std::exception&) {
+		} catch (const std::exception&) {
 			std::ostringstream msgbuf;
 			msgbuf << "Can't convert '" << val << "' to an integer.";
 			BOOST_THROW_EXCEPTION(std::invalid_argument(msgbuf.str()));
@@ -52,7 +52,7 @@ public:
 	{
 		try {
 			return boost::lexical_cast<double>(val);
-		} catch (std::exception&) {
+		} catch (const std::exception&) {
 			std::ostringstream msgbuf;
 			msgbuf << "Can't convert '" << val << "' to a floating point number.";
 			BOOST_THROW_EXCEPTION(std::invalid_argument(msgbuf.str()));
diff --git a/lib/base/logger.cpp b/lib/base/logger.cpp
index ca1f9237a..10ed3f842 100644
--- a/lib/base/logger.cpp
+++ b/lib/base/logger.cpp
@@ -128,7 +128,7 @@ LogSeverity Logger::GetMinSeverity(void) const
 
 		try {
 			ls = Logger::StringToSeverity(severity);
-		} catch (std::exception&) { /* use the default level */ }
+		} catch (const std::exception&) { /* use the default level */ }
 
 		return ls;
 	}
diff --git a/lib/base/socket.cpp b/lib/base/socket.cpp
index 3156ac52e..7d79980a9 100644
--- a/lib/base/socket.cpp
+++ b/lib/base/socket.cpp
@@ -189,7 +189,7 @@ String Socket::GetClientAddress(void)
 	String address;
 	try {
 		address = GetAddressFromSockaddr((sockaddr *)&sin, len);
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		/* already logged */
 	}
 
@@ -231,7 +231,7 @@ String Socket::GetPeerAddress(void)
 	String address;
 	try {
 		address = GetAddressFromSockaddr((sockaddr *)&sin, len);
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		/* already logged */
 	}
 
diff --git a/lib/base/streamlogger.cpp b/lib/base/streamlogger.cpp
index a7473b1fd..a10682b71 100644
--- a/lib/base/streamlogger.cpp
+++ b/lib/base/streamlogger.cpp
@@ -122,7 +122,7 @@ void StreamLogger::ProcessLogEntry(std::ostream& stream, bool tty, const LogEntr
 
 	try {
 		stream << Logger::SeverityToString(entry.Severity);
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		/* bail early */
 		return;
 	}
diff --git a/lib/base/tlsstream.cpp b/lib/base/tlsstream.cpp
index 04b810449..cc1b30458 100644
--- a/lib/base/tlsstream.cpp
+++ b/lib/base/tlsstream.cpp
@@ -115,12 +115,12 @@ void TlsStream::Handshake(void)
 			case SSL_ERROR_WANT_READ:
 				try {
 					m_Socket->Poll(true, false);
-				} catch (std::exception&) {}
+				} catch (const std::exception&) {}
 				continue;
 			case SSL_ERROR_WANT_WRITE:
 				try {
 					m_Socket->Poll(false, true);
-				} catch (std::exception&) {}
+				} catch (const std::exception&) {}
 				continue;
 			case SSL_ERROR_ZERO_RETURN:
 				Close();
@@ -161,12 +161,12 @@ size_t TlsStream::Read(void *buffer, size_t count)
 				case SSL_ERROR_WANT_READ:
 					try {
 						m_Socket->Poll(true, false);
-					} catch (std::exception&) {}
+					} catch (const std::exception&) {}
 					continue;
 				case SSL_ERROR_WANT_WRITE:
 					try {
 						m_Socket->Poll(false, true);
-					} catch (std::exception&) {}
+					} catch (const std::exception&) {}
 					continue;
 				case SSL_ERROR_ZERO_RETURN:
 					Close();
@@ -209,12 +209,12 @@ void TlsStream::Write(const void *buffer, size_t count)
 				case SSL_ERROR_WANT_READ:
 					try {
 						m_Socket->Poll(true, false);
-					} catch (std::exception&) {}
+					} catch (const std::exception&) {}
 					continue;
 				case SSL_ERROR_WANT_WRITE:
 					try {
 						m_Socket->Poll(false, true);
-					} catch (std::exception&) {}
+					} catch (const std::exception&) {}
 					continue;
 				case SSL_ERROR_ZERO_RETURN:
 					Close();
@@ -258,12 +258,12 @@ void TlsStream::Close(void)
 			case SSL_ERROR_WANT_READ:
 				try {
 					m_Socket->Poll(true, false);
-				} catch (std::exception&) {}
+				} catch (const std::exception&) {}
 				continue;
 			case SSL_ERROR_WANT_WRITE:
 				try {
 					m_Socket->Poll(false, true);
-				} catch (std::exception&) {}
+				} catch (const std::exception&) {}
 				continue;
 			default:
 				goto close_socket;
diff --git a/lib/remote/apiclient.cpp b/lib/remote/apiclient.cpp
index 0c0b17279..498090ece 100644
--- a/lib/remote/apiclient.cpp
+++ b/lib/remote/apiclient.cpp
@@ -155,7 +155,7 @@ bool ApiClient::ProcessMessage(void)
 			BOOST_THROW_EXCEPTION(std::invalid_argument("Function '" + method + "' does not exist."));
 
 		resultMessage->Set("result", afunc->Invoke(origin, message->Get("params")));
-	} catch (std::exception& ex) {
+	} catch (const std::exception& ex) {
 		resultMessage->Set("error", DiagnosticInformation(ex));
 	}
 
diff --git a/lib/remote/apilistener-sync.cpp b/lib/remote/apilistener-sync.cpp
index 62254c4b9..2dad6d6d5 100644
--- a/lib/remote/apilistener-sync.cpp
+++ b/lib/remote/apilistener-sync.cpp
@@ -135,7 +135,7 @@ void ApiListener::SyncZoneDirs(void) const
 
 		try {
 			SyncZoneDir(zone);
-		} catch (std::exception&) {
+		} catch (const std::exception&) {
 			continue;
 		}
 	}
diff --git a/lib/remote/apilistener.cpp b/lib/remote/apilistener.cpp
index 0e133ccd4..1ee950630 100644
--- a/lib/remote/apilistener.cpp
+++ b/lib/remote/apilistener.cpp
@@ -45,14 +45,14 @@ void ApiListener::OnConfigLoaded(void)
 	shared_ptr<X509> cert = make_shared<X509>();
 	try {
 		cert = GetX509Certificate(GetCertPath());
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		Log(LogCritical, "ApiListener", "Cannot get certificate from cert path: '" + GetCertPath() + "'.");
 		Application::Exit(EXIT_FAILURE);
 	}
 
 	try {
 		SetIdentity(GetCertificateCN(cert));
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		Log(LogCritical, "ApiListener", "Cannot get certificate common name from cert path: '" + GetCertPath() + "'.");
 		Application::Exit(EXIT_FAILURE);
 	}
@@ -61,7 +61,7 @@ void ApiListener::OnConfigLoaded(void)
 
 	try {
 		m_SSLContext = MakeSSLContext(GetCertPath(), GetKeyPath(), GetCaPath());
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		Log(LogCritical, "ApiListener", "Cannot make SSL context for cert path: '" + GetCertPath() + "' key path: '" + GetKeyPath() + "' ca path: '" + GetCaPath() + "'.");
 		Application::Exit(EXIT_FAILURE);
 	}
@@ -69,7 +69,7 @@ void ApiListener::OnConfigLoaded(void)
 	if (!GetCrlPath().IsEmpty()) {
 		try {
 			AddCRLToSSLContext(m_SSLContext, GetCrlPath());
-		} catch (std::exception&) {
+		} catch (const std::exception&) {
 			Log(LogCritical, "ApiListener", "Cannot add certificate revocation list to SSL context for crl path: '" + GetCrlPath() + "'.");
 			Application::Exit(EXIT_FAILURE);
 		}
@@ -205,7 +205,7 @@ void ApiListener::ListenerThreadProc(const Socket::Ptr& server)
 		try {
 			Socket::Ptr client = server->Accept();
 			Utility::QueueAsyncCallback(boost::bind(&ApiListener::NewClientHandler, this, client, RoleServer));
-		} catch (std::exception&) {
+		} catch (const std::exception&) {
 			Log(LogCritical, "ApiListener", "Cannot accept new connection.");
 		}
 	}
@@ -268,7 +268,7 @@ void ApiListener::NewClientHandler(const Socket::Ptr& client, ConnectionRole rol
 		ObjectLock olock(this);
 		try {
 			tlsStream = make_shared<TlsStream>(client, role, m_SSLContext);
-		} catch (std::exception&) {
+		} catch (const std::exception&) {
 			Log(LogCritical, "ApiListener", "Cannot create tls stream from client connection.");
 			return;
 		}
@@ -276,7 +276,7 @@ void ApiListener::NewClientHandler(const Socket::Ptr& client, ConnectionRole rol
 
 	try {
 		tlsStream->Handshake();
-	} catch (std::exception) {
+	} catch (const std::exception&) {
 		Log(LogCritical, "ApiListener", "Client TLS handshake failed.");
 		return;
 	}
@@ -286,7 +286,7 @@ void ApiListener::NewClientHandler(const Socket::Ptr& client, ConnectionRole rol
 
 	try {
 		identity = GetCertificateCN(cert);
-	} catch (std::exception&) {
+	} catch (const std::exception&) {
 		Log(LogCritical, "ApiListener", "Cannot get certificate common name from cert path: '" + GetCertPath() + "'.");
 		return;
 	}