A const_cast is only allowed when the resulting pointer is still treated as effectively const, anything else is undefined behavior.  In this case it should be okay because OpenSSL doesn't modify the pointed to memory.

By the way, I'd like it better if you pass an explicit passphrase callback to PEM_read_bio_PrivateKey() because the default callback requires us to keep compiling without -DOPENSSL_NO_FP_API.