Don't reach into BoringSSL internals. This backports 025da0aad4f9c2fdeebb64bcebf11bbf2c12a2bd and fd68c837b156ddb4b054e03d99a401e93068b34d from upstream.