diff --git a/src/core/coap/coap_secure.cpp b/src/core/coap/coap_secure.cpp
index 23983a03a..c21334c8a 100644
--- a/src/core/coap/coap_secure.cpp
+++ b/src/core/coap/coap_secure.cpp
@@ -258,7 +258,10 @@ void CoapSecure::Receive(Message &aMessage, const Ip6::MessageInfo &aMessageInfo
                      (mPeerAddress.GetPeerPort() == aMessageInfo.GetPeerPort()));
     }
 
+#if OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER
     netif.GetDtls().SetClientId(mPeerAddress.GetPeerAddr().mFields.m8, sizeof(mPeerAddress.GetPeerAddr().mFields));
+#endif
+
     netif.GetDtls().Receive(aMessage, aMessage.GetOffset(), aMessage.GetLength() - aMessage.GetOffset());
 
 exit:
diff --git a/src/core/meshcop/dtls.cpp b/src/core/meshcop/dtls.cpp
index a79562242..ade6945fd 100644
--- a/src/core/meshcop/dtls.cpp
+++ b/src/core/meshcop/dtls.cpp
@@ -102,7 +102,10 @@ Dtls::Dtls(Instance &aInstance)
     memset(&mCtrDrbg, 0, sizeof(mCtrDrbg));
     memset(&mSsl, 0, sizeof(mSsl));
     memset(&mConf, 0, sizeof(mConf));
+
+#ifdef MBEDTLS_SSL_COOKIE_C
     memset(&mCookieCtx, 0, sizeof(mCookieCtx));
+#endif
 
     mProvisioningUrl.Init();
 }
@@ -190,6 +193,7 @@ otError Dtls::Start(bool             aClient,
     mbedtls_ssl_conf_handshake_timeout(&mConf, 8000, 60000);
     mbedtls_ssl_conf_dbg(&mConf, HandleMbedtlsDebug, this);
 
+#if OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER || OPENTHREAD_ENABLE_APPLICATION_COAP_SECURE
     if (!aClient)
     {
         mbedtls_ssl_cookie_init(&mCookieCtx);
@@ -199,6 +203,7 @@ otError Dtls::Start(bool             aClient,
 
         mbedtls_ssl_conf_dtls_cookies(&mConf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, &mCookieCtx);
     }
+#endif // OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER || OPENTHREAD_ENABLE_APPLICATION_COAP_SECURE
 
     rval = mbedtls_ssl_setup(&mSsl, &mConf);
     VerifyOrExit(rval == 0);
@@ -313,7 +318,10 @@ void Dtls::Close(void)
     mbedtls_ssl_config_free(&mConf);
     mbedtls_ctr_drbg_free(&mCtrDrbg);
     mbedtls_entropy_free(&mEntropy);
+
+#ifdef MBEDTLS_SSL_COOKIE_C
     mbedtls_ssl_cookie_free(&mCookieCtx);
+#endif
 
 #if OPENTHREAD_ENABLE_APPLICATION_COAP_SECURE
 #ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
@@ -439,11 +447,13 @@ exit:
 #endif // MBEDTLS_BASE64_C
 #endif // OPENTHREAD_ENABLE_APPLICATION_COAP_SECURE
 
+#if OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER
 otError Dtls::SetClientId(const uint8_t *aClientId, uint8_t aLength)
 {
     int rval = mbedtls_ssl_set_client_transport_id(&mSsl, aClientId, aLength);
     return MapError(rval);
 }
+#endif // OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER
 
 bool Dtls::IsConnected(void)
 {
diff --git a/src/core/meshcop/dtls.hpp b/src/core/meshcop/dtls.hpp
index 6bfe8c259..20e3744c0 100644
--- a/src/core/meshcop/dtls.hpp
+++ b/src/core/meshcop/dtls.hpp
@@ -253,6 +253,7 @@ public:
     void SetSslAuthMode(bool aVerifyPeerCertificate);
 #endif // OPENTHREAD_ENABLE_APPLICATION_COAP_SECURE
 
+#if OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER
     /**
      * This method sets the Client ID used for generating the Hello Cookie.
      *
@@ -263,6 +264,7 @@ public:
      *
      */
     otError SetClientId(const uint8_t *aClientId, uint8_t aLength);
+#endif // OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER
 
     /**
      * This method indicates whether or not the DTLS session is connected.
@@ -391,8 +393,12 @@ private:
     mbedtls_ctr_drbg_context mCtrDrbg;
     mbedtls_ssl_context      mSsl;
     mbedtls_ssl_config       mConf;
-    mbedtls_ssl_cookie_ctx   mCookieCtx;
-    bool                     mStarted;
+
+#ifdef MBEDTLS_SSL_COOKIE_C
+    mbedtls_ssl_cookie_ctx mCookieCtx;
+#endif
+
+    bool mStarted;
 
     TimerMilli mTimer;
     uint32_t   mTimerIntermediate;
diff --git a/third_party/mbedtls/mbedtls-config.h b/third_party/mbedtls/mbedtls-config.h
index 34c9b80a7..071c35a97 100644
--- a/third_party/mbedtls/mbedtls-config.h
+++ b/third_party/mbedtls/mbedtls-config.h
@@ -90,16 +90,19 @@ __inline int windows_kernel_snprintf(char * s, size_t n, const char * format, ..
 #define MBEDTLS_SHA256_C
 #define MBEDTLS_SHA256_SMALLER
 #define MBEDTLS_SSL_CLI_C
-#define MBEDTLS_SSL_COOKIE_C
 #define MBEDTLS_SSL_DTLS_ANTI_REPLAY
 #define MBEDTLS_SSL_DTLS_HELLO_VERIFY
 #define MBEDTLS_SSL_EXPORT_KEYS
 #define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
 #define MBEDTLS_SSL_PROTO_TLS1_2
 #define MBEDTLS_SSL_PROTO_DTLS
-#define MBEDTLS_SSL_SRV_C
 #define MBEDTLS_SSL_TLS_C
 
+#if OPENTHREAD_ENABLE_BORDER_AGENT || OPENTHREAD_ENABLE_COMMISSIONER || OPENTHREAD_ENABLE_APPLICATION_COAP_SECURE
+#define MBEDTLS_SSL_COOKIE_C
+#define MBEDTLS_SSL_SRV_C
+#endif
+
 #if OPENTHREAD_ENABLE_APPLICATION_COAP_SECURE
 #define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
 #define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED