Oh for God's sakes. OpenSSL has a horrible API and no one should ever use it. Anyway, found one I missed during RSA-to-ECC changeover.