put BN_CTX_end in a finally to ensure it is invoked