SSL_CTX_get0_certificate
if (!X509_check_private_key(SSL_CTX_get0_certificate(ssl_ctx),
X509 *x = SSL_CTX_get0_certificate(ctx);
__owur X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx);