diff --git a/fizz/protocol/OpenSSLPeerCertImpl.h b/fizz/protocol/OpenSSLPeerCertImpl.h
index 4354db28d74..387a2a6fa4e 100644
--- a/fizz/protocol/OpenSSLPeerCertImpl.h
+++ b/fizz/protocol/OpenSSLPeerCertImpl.h
@@ -21,7 +21,7 @@ class OpenSSLPeerCertImpl : public PeerCert {
 
   ~OpenSSLPeerCertImpl() override = default;
 
-  std::string getIdentity() const override;
+  [[nodiscard]] std::string getIdentity() const override;
 
   void verify(
       SignatureScheme scheme,
@@ -29,7 +29,7 @@ class OpenSSLPeerCertImpl : public PeerCert {
       folly::ByteRange toBeSigned,
       folly::ByteRange signature) const override;
 
-  folly::ssl::X509UniquePtr getX509() const override;
+  [[nodiscard]] folly::ssl::X509UniquePtr getX509() const override;
 
  protected:
   OpenSSLSignature<T> signature_;
diff --git a/fizz/protocol/OpenSSLSelfCertImpl-inl.h b/fizz/protocol/OpenSSLSelfCertImpl-inl.h
index 4cc700c5291..60731ea72b8 100644
--- a/fizz/protocol/OpenSSLSelfCertImpl-inl.h
+++ b/fizz/protocol/OpenSSLSelfCertImpl-inl.h
@@ -30,7 +30,7 @@ OpenSSLSelfCertImpl<T>::OpenSSLSelfCertImpl(
     std::vector<folly::ssl::X509UniquePtr> certs,
     const std::vector<std::shared_ptr<fizz::CertificateCompressor>>&
         compressors) {
-  if (certs.size() == 0) {
+  if (certs.empty()) {
     throw std::runtime_error("Must supply at least 1 cert");
   }
   if (X509_check_private_key(certs[0].get(), pkey.get()) != 1) {
diff --git a/fizz/protocol/OpenSSLSelfCertImpl.h b/fizz/protocol/OpenSSLSelfCertImpl.h
index 4aac521a7f6..e5741d0d0bd 100644
--- a/fizz/protocol/OpenSSLSelfCertImpl.h
+++ b/fizz/protocol/OpenSSLSelfCertImpl.h
@@ -30,24 +30,24 @@ class OpenSSLSelfCertImpl : public SelfCert {
 
   ~OpenSSLSelfCertImpl() override = default;
 
-  std::string getIdentity() const override;
+  [[nodiscard]] std::string getIdentity() const override;
 
-  std::vector<std::string> getAltIdentities() const override;
+  [[nodiscard]] std::vector<std::string> getAltIdentities() const override;
 
-  std::vector<SignatureScheme> getSigSchemes() const override;
+  [[nodiscard]] std::vector<SignatureScheme> getSigSchemes() const override;
 
-  CertificateMsg getCertMessage(
+  [[nodiscard]] CertificateMsg getCertMessage(
       Buf certificateRequestContext = nullptr) const override;
 
-  CompressedCertificate getCompressedCert(
+  [[nodiscard]] CompressedCertificate getCompressedCert(
       CertificateCompressionAlgorithm algo) const override;
 
-  Buf sign(
+  [[nodiscard]] Buf sign(
       SignatureScheme scheme,
       CertificateVerifyContext context,
       folly::ByteRange toBeSigned) const override;
 
-  folly::ssl::X509UniquePtr getX509() const override;
+  [[nodiscard]] folly::ssl::X509UniquePtr getX509() const override;
 
  protected:
   // Allows derived classes to handle init