Move BN_CTX_start() call so the error case can always call BN_CTX_end().

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231