I don't think SSL_set_tlsext_status_ocsp_resp() can actually fail so maybe this should be a CHECK().